MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a78adc46a215dda49c554916f4783aa4f79f0d56621896d23879719489f8b19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a78adc46a215dda49c554916f4783aa4f79f0d56621896d23879719489f8b19
SHA3-384 hash: c6e5f2b187e296e2487f14ce049837ad34aaab18e77666914b9de3931ca8ec7605301fd2358681b86a18f2e990c2752a
SHA1 hash: 79e0699aecf75b8e0f6e95f4b90cec72bf30ed8e
MD5 hash: 20938a8dbb4d3deca951980605fa14f1
humanhash: uniform-fix-pizza-kansas
File name:product list.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:53'331 bytes
First seen:2020-05-28 07:30:17 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 1536:/w4NJmDdLExi+w4bygKo3UaTG26XTh/ttCfV:/v3mBLKlw4bygKYUaTGdXl/ttw
TLSH 0033F2893F6A05CEFA45C320A6BAE27474F14845873CD201DA5811F652EFF629AB37E0
Reporter abuse_ch
Tags:arj GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: diamondhillplywood.pw
Sending IP: 173.82.245.217
From: info@diamondhillplywood.pw <info@diamondhillplywood.pw>
Subject: list of products
Attachment: product list.arj (contains "product list.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1fHMTzLE9SseOcim7S24WlFi0YcUJ0kSh

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 07:37:33 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
16 of 30 (53.33%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

arj 3a78adc46a215dda49c554916f4783aa4f79f0d56621896d23879719489f8b19

(this sample)

GuLoader

Executable exe 051076f9b2c92b992e884b3ed6a67b4ca3a33611389840b15b04fce6b8a070f4

  
URLhaus
https://urlhaus.abuse.ch/url/370294/
  
Dropping
MD5 76e694a05314ed75fe69d1113679101c
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 051076f9b2c92b992e884b3ed6a67b4ca3a33611389840b15b04fce6b8a070f4

Comments