MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ff6d52a74775c2395f7afe062186168a969cb4fdf4a18ff70ca730d2a00fb2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ff6d52a74775c2395f7afe062186168a969cb4fdf4a18ff70ca730d2a00fb2a
SHA3-384 hash: f964bec3cb7b2360f73bb7de3d2f2426cd8e2fd8683db9591ba7182b6aa5e7d234314f4d367e04c20f1c496edde4194e
SHA1 hash: 929786a28f62e9c69cc517694473aac02d4c9cb6
MD5 hash: 9f06cee068652a15a9b4ab5e1092a9f7
humanhash: florida-hot-early-enemy
File name:Order FCA-742013_pdf.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-13 16:55:12 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:UgXMax1OWKPgLmYPg0/zZJ7O7O8rOBWLEQDWuAE:tcax1OWKPgLmYPhJ7O70WLE+6E
TLSH 5F459417F55DCB9DE2008AB2F57442F00569AF27E811581BF9CEFE2C377020DA6912EA
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: smtp93.ord1c.emailsrvr.com
Sending IP: 108.166.43.93
From: Jane Hostetter <barry@ciroofing.com>
Reply-To: sales@steppersexpress.shop
Subject: Re: Order Receipt FCA-742013
Attachment: Order FCA-742013_pdf.img (contains "Order FCA-742013_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.791968.25573.29081.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 17:36:25 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h73nkktuo5ochfpxv7qgegdbncuwts2p35fbr73qzjzq2kqa7mva._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 3ff6d52a74775c2395f7afe062186168a969cb4fdf4a18ff70ca730d2a00fb2a

(this sample)

GuLoader

Executable exe da40229062dc045460d3adcd70e42d15378ec4a83fd93738b30a59f5fab8da10

  
Dropping
MD5 4da30e16daaea6ebfbe19da38ffd0f7d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 da40229062dc045460d3adcd70e42d15378ec4a83fd93738b30a59f5fab8da10

Comments