MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ffd4e843982551c8900daf559ee27a07c7fdeeb6a63e5075fbb8e98c8280f605. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | ffd4e843982551c8900daf559ee27a07c7fdeeb6a63e5075fbb8e98c8280f605 |
|---|---|
| SHA3-384 hash: | c361af54d1c56108bfd5edcfcb5c6797158a186775cffbf74c331bd80f8894102e43a811720e8d76a02a155a4cf45d09 |
| SHA1 hash: | f6fda0ac50108283c21d8c52b2658480b9fa4a43 |
| MD5 hash: | ef42adb5639da871e337b4ad4df534ea |
| humanhash: | one-iowa-three-sweet |
| File name: | TV7801-19Kpcs_doc.scr |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 163'840 bytes |
| First seen: | 2020-05-21 08:53:09 UTC |
| Last seen: | 2020-05-21 09:51:38 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 8852628567eddee2c42325cf5b127620 (2 x GuLoader) |
| ssdeep | 768:Scwvngd2xzMdiavMtDssxQlUosFTmnb+NQmEOBesl1xOyaHie8b:+K0ssalUosFTmnbHmt1YnHT8b |
| Threatray | 314 similar samples on MalwareBazaar |
| TLSH | D2F390B1FB45EAA4C4A8D27CE97585F8E25E2D20C852C44726C5BD09F9F6FC738B0816 |
| Reporter |  abuse_ch |
| Tags: | GuLoader scr |
abuse_ch
Malspam distributing GuLoader:HELO: cloudserver015062.home.pl
Sending IP: 62.129.219.76
From: Sarah Bells <czby89@czbyie.com>
Subject: RE: PK4582-20
Attachment: TV7801-19Kpcs_doc.rar (contains "TV7801-19Kpcs_doc.scr")
GuLoader payload URL:
http://azureautomation.co.uk/NonsoLoader_VHLEWvfA1.bin
Intelligence
File Origin
# of uploads :
2
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-05-21 08:22:39 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
21 of 31 (67.74%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 304 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.