MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16d911d7284bead1111026e28705ff520ac433f9f8108973592eff542e53b05c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 16d911d7284bead1111026e28705ff520ac433f9f8108973592eff542e53b05c
SHA3-384 hash: 4e6ff40c000137bdb3335fcfcbe540771a9a9b32bdc12e3aaf1dca19235f22b4a2ab211fd89bde7dc9b0c11f28709240
SHA1 hash: 7a627bd92d3667cb753ef4cfa7a8fe05c6304a39
MD5 hash: 712e989f634b8cf6a58184216656cc50
humanhash: fruit-vegan-black-fourteen
File name:IMPORTANT OVERDUE REMITTANCE - MarchApril.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:29'939 bytes
First seen:2020-05-25 13:30:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:F+KZDRA5nydbBLPmHnZD+gYj0F5o4IMF+WW0S8GDf:gKZaMbCZCgYjGhIMobt8G7
TLSH 4ED2E006887A44046D1221FB3825EDB13089575692D051EBF3C990A7284DE7BFFFBD7A
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: gmail.com
Sending IP: 37.49.230.162
From: Abel Ruben<Abel.rub571@gmail.com>
Reply-To: wanlin.goh.prolink2u@gmail.com
Subject: IMPORTANT !!! OVERDUE REMITTANCE - March/April
Attachment: IMPORTANT OVERDUE REMITTANCE - MarchApril.zip (contains "IMPORTANT !!! OVERDUE REMITTANCE - MarchApril.exe")

GuLoader payload URL:
http://hosseinsoltani.ir/hilari_jReOOokyX131.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 04:50:01 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 16d911d7284bead1111026e28705ff520ac433f9f8108973592eff542e53b05c

(this sample)

GuLoader

Executable exe 70399b135fa0365dae66a01b072dd8614be73c7ff2b4cc51caeeef64dfc60ef5

  
URLhaus
https://urlhaus.abuse.ch/url/367852/
  
Dropping
MD5 3921f76b16e1c3ceecafa89f1b9e2382
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 70399b135fa0365dae66a01b072dd8614be73c7ff2b4cc51caeeef64dfc60ef5

Comments