MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 164984e97e9c3485ade1f6d58c041d6d3de960997cf46865308780e48a7dac68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 164984e97e9c3485ade1f6d58c041d6d3de960997cf46865308780e48a7dac68
SHA3-384 hash: edbb52e727f31476ebe2c86ab8ca29aadf0243791002549296f036f557dfbcc5123c4b140af6d78d7530979c4f5da329
SHA1 hash: 6ec40d0d0465bcbfcade2b3a507020756e2bace6
MD5 hash: afc00391b958de778ce1df687c05ac5c
humanhash: idaho-nebraska-oscar-timing
File name:New Purchase Order For Nazir and Sons_pdf.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:86'491 bytes
First seen:2020-06-04 10:47:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:2vHen/1kVnyHNu3D3NttJIlkXeSdUcUOsHi2g+iVq:+w1kVn4YT3NVISdUcGMVq
TLSH D283123481349E886CBDEFD55607FB5018B20B334E7DA29FF498D901839F89D35A2AE1
Reporter abuse_ch
Tags:arj GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: s1.smallhost.in
Sending IP: 103.46.239.70
From: Nazir & Sons Co. (Turkey) <rubab.s@nazirandsons.com>
Subject: NEW ORDER #063310 NAZIR AND SONS CO.
Attachment: New Purchase Order For Nazir and Sons_pdf.arj (contains "New Purchase Order For Nazir and Sons_pdf.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1cETu5zERuSRfC6MBJw9mb7yFJtNDu3G0

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 18:38:00 UTC
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=czeyj2l6tq2illpb63kyyba5nu66syezpt2gqzjqq6aojct5vrua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 164984e97e9c3485ade1f6d58c041d6d3de960997cf46865308780e48a7dac68

(this sample)

GuLoader

Executable exe 58faef99e4fcfd4f1b48907d4dcc145c0aa1013e43d938abd7a164ff46104975

  
Dropping
MD5 a54ed1e26360089c9471988c1cb7fb83
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 58faef99e4fcfd4f1b48907d4dcc145c0aa1013e43d938abd7a164ff46104975

Comments