MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ec5c9446f6ffc9fd58cf9fe954649e792fbeb11e3262273988583716c0432a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ec5c9446f6ffc9fd58cf9fe954649e792fbeb11e3262273988583716c0432a2
SHA3-384 hash: d3abd9aafdce7d196d89224485183326202deb7f707be25543c64efa65dc9f68e67d26450b73f456a0910f8ecbcbd8ab
SHA1 hash: 2f0a2dcbc73ac8c5f57f9779c87f3cae306890fe
MD5 hash: cff88c08225995d50586892647323747
humanhash: beryllium-cat-april-blossom
File name:Invoice 11205034886.iso
Download: download sample
Signature GuLoader
Create hunting rule
File size:782'336 bytes
First seen:2020-08-16 13:54:00 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:Dq9CRixt4LFWJB0UWJ1J30s1nIiu88yQrv2wzaOJ7:m0kuHbJPpl/QrXOOJ7
TLSH B6F46E22B2D07433C132167A9D3B6374A82ABF152E29A9467BF84CCC5F3A6433575397
Reporter abuse_ch
Tags:GuLoader iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: winterfell.networkredux.net
Sending IP: 209.191.187.244
From: Env Billing <env.billing@imdaad.ae>
Subject: IMDAAD LLC - Invoice Submission - Invoice Number : 11205034886
Attachment: Invoice 11205034886.iso (contains "Invoice 11205034886.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
228
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ec5c9446f6ffc9fd58cf9fe954649e792fbeb11e3262273988583716c0432a2/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-08-16 13:55:06 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h3c4srdpn76j7vmm7h7jkrsj46jpx2yr4mtce44yqwbxc3aegkra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3ec5c9446f6ffc9fd58cf9fe954649e792fbeb11e3262273988583716c0432a2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso 3ec5c9446f6ffc9fd58cf9fe954649e792fbeb11e3262273988583716c0432a2

(this sample)

GuLoader

Executable exe 2bb3ec5f6e8830a1b8e87a95bcb53406688386e7dd33149bb8117318f28faba9

  
Dropping
MD5 ea8b22c4f7790cfb5dd8fa15f97ac4b7
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2bb3ec5f6e8830a1b8e87a95bcb53406688386e7dd33149bb8117318f28faba9

Comments