MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbb7024e3cb635d49b69e56354fd69915a4b2a2e57f03bba818958d2aee5d46c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fbb7024e3cb635d49b69e56354fd69915a4b2a2e57f03bba818958d2aee5d46c
SHA3-384 hash: 8be334cb383d6e2c9b2601cd642434764020868c3bf66b39324ed8d5ccde92ec7c53b36682cfca5cb95ab4301fd37432
SHA1 hash: 3297ceb72fd1a6edce0f6766a9e06413b89c55ac
MD5 hash: 58604ae63aea84483c67980369958acb
humanhash: johnny-charlie-diet-kilo
File name:Payment#054.pdf.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:90'112 bytes
First seen:2020-05-13 05:13:14 UTC
Last seen:2020-05-13 05:55:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9576f6f3626c13fc3f8fba9c02240d3b (1 x GuLoader)
ssdeep 768:8vxN/hOXVJp0+Pr8DSsA1c1zxLwsB/JEPYicyGUdXjpT731JQ6jugfFhyW:cxB2LpLPHsZxxLJBBhUp7L
Threatray 189 similar samples on MalwareBazaar
TLSH D7932B22F9A44532E6558A709B3CCBDD035BEDB02B15894739C13D7D0A3BA56A27323F
Reporter jarumlus
Tags:GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.GenKryptik.EKMN.3865.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 05:30:11 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7o3qetr4wy25jg3j4vrvj7ljsfnewkrok7ydxoubrfmnflxf2rwa._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
0c86b7ceab16758dd8095aaceaf939cecb1c533d7389a60285bcae4e6b4896ae
GuLoader
4b5e08d727e3e43db31db4f514737a9ac90088bb581df44beb9c0ca2c0d9bb07
GuLoader
57aa81416cfdbd76df2a15cb14810f8529ecab0eea978210a4ef3047f35a225e
GuLoader
630ff6cc27be458de812bb51580a983819505b604f68e14373338a05bed0ee6b
GuLoader
8f210b4c2f5216320ff823a3bd8fc08b5ff051ea13fb1bf169672257b6693115
GuLoader
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
GuLoader
c121b14316a1f7976c4337f37c29acd3a1efeff592617736b1ae1e6d3bf04b09
GuLoader
c8b1cce5ae65d68b7ca2a419b1499d7bec6e4e3d1e04d3e3f040eeaeb6080146
GuLoader
ce34b2b2da3172b4786d808d218ff295a12d69e36847ad449c88c78cf9241cad
GuLoader
e943534d22e73e0d062b7917c007b744ce19014e0a0c90dfd37219281bcf204b
GuLoader
+ 179 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-dx2x5as2ja/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 5c84fead84918ec7d6b88a2a8cabdbf8f5abf15f15a4c179676bfa03d52fb4b7

GuLoader

Executable exe fbb7024e3cb635d49b69e56354fd69915a4b2a2e57f03bba818958d2aee5d46c

(this sample)

  
Dropped by
MD5 c759e2555941e197377d1e13e372b40c
  
Dropped by
SHA256 5c84fead84918ec7d6b88a2a8cabdbf8f5abf15f15a4c179676bfa03d52fb4b7
  
Delivery method
Distributed via e-mail attachment

Comments