MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 fb98989e3e598841af7312f2d7eb011d9dafcd031caf39e39e7208ba37590ad5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | fb98989e3e598841af7312f2d7eb011d9dafcd031caf39e39e7208ba37590ad5 |
|---|---|
| SHA3-384 hash: | 6037be381e1842dd28a7a37e8b13ea74eab56a4c805f5d3a363c41c87f6669f37afb52b937f950a287b7b12df80de667 |
| SHA1 hash: | f3785b2572f9114ceae7e7d78bc347257e70e515 |
| MD5 hash: | 9aa672d4747104526c4a766a47f87bf1 |
| humanhash: | snake-burger-muppet-violet |
| File name: | sales.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 126'976 bytes |
| First seen: | 2020-05-26 11:19:51 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5a8574dc0e0b14bba3a0dc7718b0032b (1 x GuLoader) |
| ssdeep | 1536:1LifUixbLks2MnssfXZoQIvKR4rtNO518DEczbrs:kxss2qZfWG5RczM |
| Threatray | 185 similar samples on MalwareBazaar |
| TLSH | 39C34C26B9C84EA2D8691FF51C672DAB2D2BAC311A181F0B3246F65C77761C32CF1716 |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader |
abuse_ch
Malspam distributing GuLoader:HELO: gfh3.gfh-net.de
Sending IP: 85.236.43.173
From: DKV EURO SERVICE GmbH + Co. KG <warth@lieferanten-marktplatz.de>
Subject: AW: AW:Payment and Order Confirmation 29-04-20 INVOICE_20-613129926-001
Attachment: sales.zip (contains "sales.exe")
GuLoader payload URL:
http://156.96.118.179/RAW-4-DAVdx_xtLnf95.bin
Intelligence
File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Azorult
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-26 11:37:20 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
25 of 30 (83.33%)
Threat level:
5/5
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 175 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.#Azorult
https://capesandbox.com/analysis/4972/