MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d63e6abbbf71bb71a40cf3bbb7317817ca1be8f7be5bb61970236d40a36f711. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1d63e6abbbf71bb71a40cf3bbb7317817ca1be8f7be5bb61970236d40a36f711
SHA3-384 hash: 96a8a6ab3319e1ce244ec1652ba78334ed211fb5c3670f2fbef2c7e1d5fe61948dc3b76dc412cb71c3d7e572dd5a9272
SHA1 hash: 2678e65eb274a6651609d41bd427c9de4542f27e
MD5 hash: f0fdd3ed71dc2b9b74346a63fd13e018
humanhash: stairway-virginia-oscar-pasta
File name:QPO700125210.r15
Download: download sample
Signature GuLoader
Create hunting rule
File size:29'640 bytes
First seen:2020-05-26 07:36:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:j5PjMMlsB9XNrTzoVnRQV9Tm/DoXkBU1f:qMlCd3zoVn0USF
TLSH 92D2F11149BCB5DDE7AAB8F08044CA36D6D086CAB65EAC85E89DF058ECD18E19DF8007
Reporter abuse_ch
Tags:GuLoader r15


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: ip-143-95-1-124.iplocal
Sending IP: 65.75.136.134
From: Qatalum Services LLC <info@qatalum.com>
Subject: Qatalum RFQ 700125210 Supply
Attachment: QPO700125210.r15 (contains "QPO700125210.exe")

GuLoader payload URL:
http://www.mailserverservices.info/tex_vYZnl64.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Grp
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 17:22:09 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
18 of 48 (37.50%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 1d63e6abbbf71bb71a40cf3bbb7317817ca1be8f7be5bb61970236d40a36f711

(this sample)

GuLoader

Executable exe 0e319c36c39c8504a0349445b2282bc450758b7e670a3477c0653b1daafffaff

  
URLhaus
https://urlhaus.abuse.ch/url/368642/
  
Dropping
MD5 28b4dcf953a422b4e6de0179e6f01932
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0e319c36c39c8504a0349445b2282bc450758b7e670a3477c0653b1daafffaff

Comments