MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14375d198851824c9ddb6515e97132800007db4e1aaf6ccd1fe882d03bf5f7dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14375d198851824c9ddb6515e97132800007db4e1aaf6ccd1fe882d03bf5f7dc
SHA3-384 hash: b14a7a28f8cf48464da879c165d95ad492730355244f592aa97a833ee128876cf3f0284b98b6fc46c5df24720bfdf85a
SHA1 hash: 09713d7031df365ef720e726e6f5b1c4ec7a7262
MD5 hash: b74e875297bab40e2d7585590b3fca8a
humanhash: kentucky-burger-massachusetts-equal
File name:Proforma Invoice.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:28'856 bytes
First seen:2020-05-27 17:28:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:2RmUjEGYs8uRjEua1+JzWGjgf1bIEvKE+OJAQbu34n9:2cUwGYsFRjEz1+JzhgxKf8A8
TLSH E5D2F103D9093C59089DB93DA16231229D7A80B6BD094BE3D24BF63F9EB23BF9354048
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: vps.aquawetsenterprises.com
Sending IP: 45.95.169.142
From: Accounts <info@aquawetsenterprises.com>
Subject: Re: Proforma Invoice
Attachment: Proforma Invoice.rar (contains "Proforma Invoice.scr")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1kWndZjaiq3zAyEpOHvYA0IzCi2wTa4oE

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 17:36:34 UTC
AV detection:
15 of 30 (50.00%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 14375d198851824c9ddb6515e97132800007db4e1aaf6ccd1fe882d03bf5f7dc

(this sample)

GuLoader

Executable exe 3f88c57eb7f5eb4e623183ce4b3d06ad3987000282cb09b184a9854fd592c766

  
URLhaus
https://urlhaus.abuse.ch/url/369935/
  
Dropping
MD5 385bfdf4764f578f238102750065fdb4
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3f88c57eb7f5eb4e623183ce4b3d06ad3987000282cb09b184a9854fd592c766

Comments