MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43adb2b66d7a4aa7bd9d0da3a8c4c106a5a52b79bba03e6f13fee1c5493975b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43adb2b66d7a4aa7bd9d0da3a8c4c106a5a52b79bba03e6f13fee1c5493975b3
SHA3-384 hash: 2af258e447ac394cd25808e66ec7fed9eaed127406157fd4439ac91f7339ca57030d0c3a12dd80f6cabacad0a90f0dcb
SHA1 hash: 49ebdaefd65042479c1252181d5f78e322e755ff
MD5 hash: 7bf5ca5d3d4cb81335feb041ce104126
humanhash: bacon-charlie-blue-magazine
File name:DHL.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:26'040 bytes
First seen:2020-04-25 08:54:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:theYCe5TkLMGNxk+0XCSzKIBhOhI4hpnHA:thAJMqu4hpHA
TLSH 24C2F1280A862F9BF97700A5752C47A188264337ED9E33B691F4F98F9810B5635F403B
Reporter cocaman
Tags:GuLoader zip


Avatar
cocaman
Malicious email
From: "DHL DELIVERY" <info@urommats.com>
Received: from slot0.erageran.xyz (slot0.erageran.xyz [45.95.169.208])
Date: Sat, 25 Apr 2020 01:27:42 -0700
Subject: RE-CONFIRM YOUR ADDRESS TO RECEIVE YOUR PACKAGE AFTER COVID-19 LOCK DOWN
Attachment: DHL.zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.42531.15291.7459.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-25 09:35:31 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iow3fntnpjfkppm5bwr2rrgba2s2kk3zxoqd43yt73q4ksjzowzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 43adb2b66d7a4aa7bd9d0da3a8c4c106a5a52b79bba03e6f13fee1c5493975b3

(this sample)

GuLoader

Executable exe 7f74994cfed1a06818e7083a8d1f462065a21d23d742e59ff0a9a66a6bf93bf5

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7f74994cfed1a06818e7083a8d1f462065a21d23d742e59ff0a9a66a6bf93bf5

Comments