MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 221a8b65a8100ccb20d09732da20a5a92202772c13e743d371136a7352421cc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 221a8b65a8100ccb20d09732da20a5a92202772c13e743d371136a7352421cc5
SHA3-384 hash: 7d6b4efe9d578bcec82a1f1dc3dc14d40747ff4eb361901a21fc894a335532a92c314b02656d601286e3d6f4c181bf19
SHA1 hash: cd823e32e9660b9801b7b47e504fcee7f5f55de3
MD5 hash: 3029352959a2697e897ac0683190b3b7
humanhash: oven-oklahoma-carbon-potato
File name:Details.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-04 06:03:34 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:iISPfxV40NafMCekgrKHxLdGKc+o0FDHdZ1gIHJFEW8VRuDbD2Kxn:iPXNafeKVdhjFD9zGivxn
TLSH F8456C03EE488553C1989FF92D135D7A7B2CA90E0D414BEF323D7E5AAF356421CAB119
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: slot0.coinfxpumps.com
Sending IP: 45.95.169.160
From: Nicole Gapes<info@coinfxpumps.com>
Reply-To: gapes.nicole@yahoo.com
Subject: Property Purchase & Leasing
Attachment: Details.img (contains "Details.exe")

GuLoader payload URL:
https://pinkbroadband.in/images/blog/Thumb.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 21:06:34 UTC
AV detection:
13 of 31 (41.94%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=einiwznicagmwigqs4znuiffverae5zmcptuhu3rcnvhguscdtcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 221a8b65a8100ccb20d09732da20a5a92202772c13e743d371136a7352421cc5

(this sample)

GuLoader

Executable exe 0e7ec69a6222b2753c0167997838b380acfd47834a6d1e7dd2475fd4fe07d63c

  
URLhaus
https://urlhaus.abuse.ch/url/376292/
  
Dropping
MD5 8fb99d5712cae49ecfe2e49223d4b0c6
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0e7ec69a6222b2753c0167997838b380acfd47834a6d1e7dd2475fd4fe07d63c

Comments