MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff8da3f9d4933d6a6b600d3b34e2fad0e00d9a82cb056a33ed030c16d75a944a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff8da3f9d4933d6a6b600d3b34e2fad0e00d9a82cb056a33ed030c16d75a944a
SHA3-384 hash: b04c0245b0a50b86a8902859efa74a0765a4857a791921037798896ac1b9a9c045b6e112bcc3748fe01d51e89f7ba4bf
SHA1 hash: c255290991fc8bb73e29e1b98866bee1f9bec9da
MD5 hash: cd5c0d629706c9eb0709107542a0e324
humanhash: east-september-illinois-oregon
File name:DIVISIONSCHEFERNESMA.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:151'552 bytes
First seen:2020-05-28 07:04:22 UTC
Last seen:2020-05-28 08:22:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 37c68354baae054ec7f3c5b3d3f40c18 (1 x GuLoader)
ssdeep 1536:3L/1CrLNyvaq4Tai49YI2OqCXka/t31PoLInIkKynkmmARCft7X8j:uxA9YI2+FdoL6IcnZMfpE
Threatray 783 similar samples on MalwareBazaar
TLSH F7E38512BAD9AC7DC58A39F19C89589A2A0A6D00BF0412EF11D4F77D72368F17C71B1B
Reporter abuse_ch
Tags:exe GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: slot0.boellhof.com
Sending IP: 45.95.169.21
From: Ms. Wong Jeong <smbwz@mail.hz.zj.cn>
Subject: FW: Emailing: Payment 28 05 2020, INVOICE 20.05.20 Baltic Processing SIA
Attachment: PAYMENT TELEX.IMG (contains "DIVISIONSCHEFERNESMA.exe")

GuLoader payload URL:
http://185.205.209.166/wext/ori-2_vQiXO168.bin

Intelligence

File Origin
# of uploads :
2
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/5794/
Detection(s):
SecuriteInfo.com.Heur.PonyStealer.jm0@FqqfTbi.1596.24404.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 07:38:15 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
14 of 31 (45.16%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
09838078bc786269db65986e324234d647ff0154b07565e59bdf34f5f72d650d
GuLoader
1d117728ec260d80f6c6a347c4c32c965c69ff10bd4f08444fc70e82eebb1094
GuLoader
2514cc0d95a79227b308e5834eb780ba105109fcc7fc02fc11ef3a03e61cac46
GuLoader
2b2166f900572c98775661fd3905d86451e7470c2e548fe234f20f2069c93331
GuLoader
396c67d17bdba56c29d4774991879313c236e9db5b9e1173f322d1bd3194edd1
GuLoader
884209a719966f7d043193d01453eb707f176dab896173c493097f09940ded43
GuLoader
8e01834fb94698ea94b41965f1847d283f14daaad211d567ee199b6b2caa0992
GuLoader
bd5078b8e00c23e3396bf5b38e6df45d329bdc62b441723d39f732780d1e8f2e
GuLoader
c3242f5a544110304212594891c9f8bb0c2e61f29d904271a09f5b0f94437348
GuLoader
df34eee3a23ae66bb689bc1911e417cdaa7b51c353dc586bdb3280f86df09b55
GuLoader
+ 773 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-xa8pp3d2fa/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img d13c636473174bbdbbc98895f8f05fb4ba97323c8c52b8473655f7248b353e76

GuLoader

Executable exe ff8da3f9d4933d6a6b600d3b34e2fad0e00d9a82cb056a33ed030c16d75a944a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/370259/
  
Dropped by
MD5 b7adc3984903da49aa176cbea1fa88bb
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 d13c636473174bbdbbc98895f8f05fb4ba97323c8c52b8473655f7248b353e76
Cape
Cape
https://www.capesandbox.com/analysis/5794/

Comments