MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e5d66a89a9a2c58c1d5ee943eefe7db569511a37c33c3e7ce9a0fcc6ef27597. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e5d66a89a9a2c58c1d5ee943eefe7db569511a37c33c3e7ce9a0fcc6ef27597
SHA3-384 hash: 42d20502f80c9f2d48cc9a3ea6efc54ca9275833813c8ac2798e1f7b53b7b966397a01c0c1380132e6d77dcd7ed50cfc
SHA1 hash: 7900401f8296e163b96a2e980583bf49ffd0b3b1
MD5 hash: 902298957680a0f73875dc75b0f9247c
humanhash: utah-march-bravo-utah
File name:doc05282067665898688.scr.z
Download: download sample
Signature GuLoader
Create hunting rule
File size:60'407 bytes
First seen:2020-05-28 13:17:40 UTC
Last seen:Never
File type: z
MIME type:application/gzip
ssdeep 768:wkqLHDUVB9hutgWFlrZlIuGWLr/mNSkk1le5Kv2Q5rw9XtZZp/lG22XlJpvjapjO:vhF0lrQub//lkOk/0uPPk22Xlba9e
TLSH 2D43F1C4865B369B316B8782E5001BC872C3EAB69A1F063259A44FDFA5CF5FB046C25C
Reporter abuse_ch
Tags:GuLoader z


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: ggkorea.co.kr
Sending IP: 192.129.189.208
From: Veronica <veronica@ggkorea.co.kr>
Subject: Re: SP 21 Woven Top/Dress Fabric Follow Up
Attachment: doc05282067665898688.scr.z (contains "gunzipped")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1qJ1bywJ84j6KAC1qYO9XPmviM6AS8b64

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Injector.EMDX.9146.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Inject
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 13:37:15 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

z 0e5d66a89a9a2c58c1d5ee943eefe7db569511a37c33c3e7ce9a0fcc6ef27597

(this sample)

GuLoader

Executable exe 3371cb1ea5c1990f19e0141454e418ba8e30d70c140d5f4cd3e797aa80a9bb9c

  
URLhaus
https://urlhaus.abuse.ch/url/370974/
  
Dropping
MD5 2d7f2df4220cee32dee1c8acb91ba4a2
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3371cb1ea5c1990f19e0141454e418ba8e30d70c140d5f4cd3e797aa80a9bb9c

Comments