MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f973662b7b7eebaa4972fd81f706c28e99ebe58972f8d5d07f7f6630ac54449. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f973662b7b7eebaa4972fd81f706c28e99ebe58972f8d5d07f7f6630ac54449
SHA3-384 hash: 2bb390d6eca5341d88411689652aec8c08d01627a3543787685ba6fd9214ddc9ee02f43623887398b1a18e7a9042f6ba
SHA1 hash: 65ef63ab09f9c3375f10552f274441eba4d8df26
MD5 hash: a18eefa5327bd8615c1e1185b2ae5459
humanhash: mexico-violet-wolfram-oregon
File name:new PO.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:29'781 bytes
First seen:2020-05-26 11:22:37 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:v8CzZZw5J6D4JD7wmWL1tO49nfvvxcAXSI7ZRoHJJ/zw5gfAGnc0LI8aLWS9:UqwH7J3M/xnFXSIUJ/EaZn6h
TLSH 3BD2F12C1045EB94C6F6D5A92DBDEDD0A460B6C86B3DF188F82140D6774D2193E2FCA9
Reporter abuse_ch
Tags:GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: da.databaseapi.live
Sending IP: 45.95.171.161
From: Luminita <Luminita@gmail.com>
Subject: Purchase Orders 217443 and 217444
Attachment: new PO.gz (contains "new PO.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=B1239884E2DEB3B9&resid=B1239884E2DEB3B9%21648&authkey=ABuZ3TBAqlkKWHE

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Guloader-7900546-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 11:36:48 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 1f973662b7b7eebaa4972fd81f706c28e99ebe58972f8d5d07f7f6630ac54449

(this sample)

GuLoader

Executable exe 14c8beb98883ae6bfe985e3f5d7deca650fc2bed76f17da4cf3ce7ae7c2bfced

  
URLhaus
https://urlhaus.abuse.ch/url/368810/
  
Dropping
MD5 493a292f92ab94b1d0b83e6b8b7adefc
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 14c8beb98883ae6bfe985e3f5d7deca650fc2bed76f17da4cf3ce7ae7c2bfced

Comments