MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38a3aac96a89ed3e3f5b3d8ea8bb3b95ba25d2d38a0d02a7324590b1485d81a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38a3aac96a89ed3e3f5b3d8ea8bb3b95ba25d2d38a0d02a7324590b1485d81a5
SHA3-384 hash: b53feabfe892b1e986b1ed62bbcbb5a1274af3d9f08e33037f710b2cd657a916a980ac1fdc829f3bd9964c7b44893dc1
SHA1 hash: a836744570a3f8d7dcf248e17d3ea55092f0958c
MD5 hash: 302a7400cd2dffe963934ff724fafeae
humanhash: six-jig-romeo-island
File name:order 52242020.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:24'039 bytes
First seen:2020-05-22 10:25:01 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 384:vrDEIO4iIACgKF3Y860Ez6heJ3FczWGtnkTs5PUHn4JN40PMDneFeviC:jDEqjpEBJnLgtUYf4GMDneFQ
TLSH 3AB2E1E0E1097D722868802F68BFE685BC6F2198BBC54D3885F1785625D9D283B73B84
Reporter abuse_ch
Tags:arj GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail.euromaster.es
Sending IP: 82.223.70.126
From: Evangelos Fasilis <tdroggitou@deloudis.gr>
Subject: Re:New Order
Attachment: order 52242020.arj (contains "order 52242020.pdf.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1jMZLcuxisSMShYRaNdb03Q0Hh6mmbwio

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 10:36:50 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

arj 38a3aac96a89ed3e3f5b3d8ea8bb3b95ba25d2d38a0d02a7324590b1485d81a5

(this sample)

GuLoader

Executable exe 2b551d98f7cfab5065bab4df3eae19af497e729a5dbe63655a8527988fb28ca1

  
URLhaus
https://urlhaus.abuse.ch/url/366534/
  
Dropping
MD5 cd02e269190b5f70b49b03de928b315e
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2b551d98f7cfab5065bab4df3eae19af497e729a5dbe63655a8527988fb28ca1

Comments