MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b144dba04aad21077a171e5343a23ef5e14a0399f94f14dbf4383096d65b284. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b144dba04aad21077a171e5343a23ef5e14a0399f94f14dbf4383096d65b284
SHA3-384 hash: 88666bb2c1ac20d9ded00278ae5109dd9a8c6947010614bf3f3a87f9c7b8bf03dc189826847ad1f5be2f7ef9d4c83c4c
SHA1 hash: 138d168d730be24635c817c07fdcfc25cc767794
MD5 hash: 5a44cc7a3f8782def9cc5e42aec700d1
humanhash: mountain-magnesium-indigo-fix
File name:file.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:22'780 bytes
First seen:2020-05-13 10:04:19 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 384:mJhDYyw+uP9UbhubuPpi+kPJXp+lDgFSHBVRQa0L+z16GJIneZWlY3+Jw:mXDYnP9UdubIpjrDo8VQa4+JInc
TLSH CFA2D063EC8B65B31BF443E7E9BE8FCD484D8F928963A5A319474124A870F14A4B3774
Reporter abuse_ch
Tags:geo GuLoader gz THA


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mx1.chaiyohosting.com
Sending IP: 58.181.206.8
From: Sunisa Arunsiri <kyvc_engineering@hotmail.co.th>
Reply-To: bbkeIc@outlook.com
Subject: คำเชิญให้จัดหาสินค้า
Attachment: file.gz (contains "file.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 10:36:33 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dmke3oqevljba55bohstiord55pbjibzt6kpctn7iobqs3lfwkca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 1b144dba04aad21077a171e5343a23ef5e14a0399f94f14dbf4383096d65b284

(this sample)

GuLoader

Executable exe e943534d22e73e0d062b7917c007b744ce19014e0a0c90dfd37219281bcf204b

  
Dropping
MD5 0053c151b79516aef5bec9ba7bf8434a
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e943534d22e73e0d062b7917c007b744ce19014e0a0c90dfd37219281bcf204b

Comments