MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00cd51fb0185d85cdff4ebaf131c2985246862e35236fa2ccb5d35b8ddb5f484. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00cd51fb0185d85cdff4ebaf131c2985246862e35236fa2ccb5d35b8ddb5f484
SHA3-384 hash: 265f3e7bc4d826dff7b984c2f7f6b40e4946c9e492b7cbe8d1b2da31bb0e178c92f327e975e53c12977f619ff3342729
SHA1 hash: e023289c52132d8a306527cf8f4b45206d4f7905
MD5 hash: 71212239343b1eee9a3285333342a39f
humanhash: island-social-magazine-alaska
File name:bank details.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:29'953 bytes
First seen:2020-05-27 17:37:33 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 768:wcLy0UopLFN+jIsGD3Rs77I2sZ5AoqwnIF:wcOfELFNeM/5AoRIF
TLSH 55D2F1A407EA4C8F104C0B2A96357108D9EFB56687AEE0D085FC0563EB84EDBE6DC8D1
Reporter abuse_ch
Tags:arj GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: thealtitudestore.com
Sending IP: 199.43.204.176
From: Angel Frco. Ruiz <veges@thealtitudestore.com>
Subject: Re: Confirm account details for payment
Attachment: bank details.arj (contains "bank details.bat")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1MN7gXpYwUQZxDVOyHBkQ7Rw-LCB0M3VW

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 02:57:00 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

arj 00cd51fb0185d85cdff4ebaf131c2985246862e35236fa2ccb5d35b8ddb5f484

(this sample)

GuLoader

Executable exe eddacc373c3a12d02cfb1398299eaa3bbb815e090eb8640883dbc67adcd23a80

  
URLhaus
https://urlhaus.abuse.ch/url/369977/
  
Dropping
MD5 12617d70430492917fa4b92a2441093e
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eddacc373c3a12d02cfb1398299eaa3bbb815e090eb8640883dbc67adcd23a80

Comments