MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f2dde6869e7419c3aceadbf6ff5b8f33d7f56ce092d96e9ddb7226f837c0cf6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f2dde6869e7419c3aceadbf6ff5b8f33d7f56ce092d96e9ddb7226f837c0cf6
SHA3-384 hash: 34117bd82a0fa0237355ac92cc22023feae5c6b66cdd75f2e31bdb3c065d870de82050ab68413ddf6a0e3456ca09c659
SHA1 hash: 425a099e2cc3b6c1d6b77f25c04a73587438e258
MD5 hash: a8ff9f0518fd2453b055608824ca0d81
humanhash: sweet-earth-maine-carpet
File name:factura.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:53'025 bytes
First seen:2020-05-28 13:17:02 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:J5pFfDr3TWApKw3uETHz8gSRaOCYK50TYVutOo4jXXg2aw2+FFVPjdsu4OUAVU:J/tr3iApKw3OLaXYK50TYskA7MDmOpe
TLSH B13302682637A25BF9D4EF7EC49701DA7700FF1AF1B6AB115B1F0EE4121A19282C0C1E
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: horus.visualtec.host
Sending IP: 213.149.231.2
From: Paola piscinas <administracion@ars-iuris-abogados.es>
Subject: FACTURA 87
Attachment: factura.rar (contains "factura.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1JGEN1x_ZUhssG_Jw0_WjJLCVpGgLj7Ay

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 13:37:24 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
7 of 47 (14.89%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 1f2dde6869e7419c3aceadbf6ff5b8f33d7f56ce092d96e9ddb7226f837c0cf6

(this sample)

GuLoader

Executable exe 72da06afa192a25cd6794024139a257d5b19eed726763a9014fc8bb28f2f47db

  
URLhaus
https://urlhaus.abuse.ch/url/370977/
  
Dropping
MD5 3dc8949311b4fe9bd65f2e97e7c166ba
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 72da06afa192a25cd6794024139a257d5b19eed726763a9014fc8bb28f2f47db

Comments