MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38c82294e614a767e70483df7d5f10eef68df940bff650938be9adeb4ec7c6fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38c82294e614a767e70483df7d5f10eef68df940bff650938be9adeb4ec7c6fd
SHA3-384 hash: 56324561da9dfd04e9bf6b51d0220301ddb77608e075db8ef54d3532cabc705109dc64e02fc242bd970930d68a55d123
SHA1 hash: 11319eb711e0ba2cd66a8c2d2a924d5e5e986883
MD5 hash: 7602e37eecb2657e42d4532dcb408193
humanhash: lactose-india-fix-music
File name:Remittance Advice.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-28 07:19:22 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:iRMTIqqkUlyya2h8xbRgJ0bQcjmcMEnNAq32VtdtDNMWmu74BPmUELx:38k+y32+x9gJ0bNm6NAM2VpNBV
TLSH 98454D22B726DCA2E5450570D8E1DCF40820BC14DA039A2B7FCD7F2E7BB51D2696636B
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server.adexconstructions.com
Sending IP: 162.241.215.119
From: messaging-service@post.xero.com
Subject: Payment has been made by Crushed Glass Concepts Pty Ltd
Attachment: Remittance Advice.img (contains "Remittance Advice.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1Kh21PDvu8kEHCBALcoX3fI52CNzNTtkn

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Noon-7585277-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 07:37:17 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 38c82294e614a767e70483df7d5f10eef68df940bff650938be9adeb4ec7c6fd

(this sample)

GuLoader

Executable exe 8b04dcca28022f6065a0aab229d6fb466ae313dc5dda21b0a7222225d0facfd5

  
URLhaus
https://urlhaus.abuse.ch/url/370276/
  
Dropping
MD5 119e087cc0f8fb1e68c7675af1b7e541
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8b04dcca28022f6065a0aab229d6fb466ae313dc5dda21b0a7222225d0facfd5

Comments