MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3413c0a4d9f7dd27766e7b94f9c317a6ea3eddda13e27c83d3dbf4cc8685099c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3413c0a4d9f7dd27766e7b94f9c317a6ea3eddda13e27c83d3dbf4cc8685099c
SHA3-384 hash: 4dac2613e1b1b32ccc0dd3a45fd2e4bd767927fa96ad970879fec4e2861ce74650262d9f2610db944f0ca2d4c87b8622
SHA1 hash: 150425b3f7c269263cb5d7c4616e88e7cb8b1207
MD5 hash: e84641d5aba829c311815fb728f035cf
humanhash: nebraska-london-texas-oranges
File name:Outstanding Invoice_PDF.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:24'027 bytes
First seen:2020-05-22 09:46:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:meH1fSTDMVY67lIMtKmEkdV6v1fd7FD+1ZSMaN8VXtkR707V812E:TZShMtKcSZD+feG9tkR707y1v
TLSH 62B2E15F899063D8DF1D9CF8325C8C209BA69D5113AD2A98C7B9D390FD41F79E88530E
Reporter abuse_ch
Tags:arj GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: lia-kaf.am
Sending IP: 83.139.2.20
From: RED ALPI MARINE CO.LTD <dr.mohammedalkettan@dbtsa.net>
Subject: Invoice details confirmation and Remittance of outstanding USD 212,405.24
Attachment: Outstanding Invoice_PDF.arj (contains "Outstanding Invoice_PDF.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=16pdtfZQsIuTKlvUWbPTFf7qt38rdyUVy

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 21:01:25 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
33 of 48 (68.75%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 3413c0a4d9f7dd27766e7b94f9c317a6ea3eddda13e27c83d3dbf4cc8685099c

(this sample)

GuLoader

Executable exe 72cba3fc465152c8ca9ddf2de472974ad26c0881ba3b85735358381c862cb3a9

  
URLhaus
https://urlhaus.abuse.ch/url/366485/
  
Dropping
MD5 cfb4406525a24282d9af29fa6588f036
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 72cba3fc465152c8ca9ddf2de472974ad26c0881ba3b85735358381c862cb3a9

Comments