MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47c5eb7a419ecd3748cfa2ad302ad6fbc374c17f146cc79e9ff5ecfffb03b73a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47c5eb7a419ecd3748cfa2ad302ad6fbc374c17f146cc79e9ff5ecfffb03b73a
SHA3-384 hash: 62409e0f509f2a4371c19a0605e0f2007b074955bf73368890cfe01e4d85583373d956d4f55022b48a258c7478d113bf
SHA1 hash: e1adeb969e214418118a8e941a375c37039fd4c0
MD5 hash: a8864b92b7a89ae6b9b0a0b8780d95ff
humanhash: early-salami-cola-aspen
File name:NEW FOB KWANGYANG_images_.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:27'308 bytes
First seen:2020-05-26 07:36:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:ZsjUMNxNwPB7cQGaQt7qL7hZd066tg+vDZmNehznKYkmqYWK1u:ZPMDNqBQfWLzdg6+vVmNehzMmfWK1u
TLSH 98C2F1E4E3CC432776F012634C1FD6A663B5DE404BEC847FDA81190788899EA9653FB2
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server.example.com
Sending IP: 103.114.106.250
From: Jason Bourne <admin@mogioan.cf>
Subject: NEW FOB KWANGYANG Seaport Korea to Karachi Seaport Pakistan.====OLYMPIA
Attachment: NEW FOB KWANGYANG_images_.rar (contains "Filmmssigebal9.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1T5CJ00ZJFsLm6bvBZgXGXd9nqoeKd21O

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 08:41:07 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
14 of 30 (46.67%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 47c5eb7a419ecd3748cfa2ad302ad6fbc374c17f146cc79e9ff5ecfffb03b73a

(this sample)

GuLoader

Executable exe 4da0526019c843ade96399a33f2a5e9a9d8e415d69859ee8c7874439956c131c

  
URLhaus
https://urlhaus.abuse.ch/url/368643/
  
Dropping
MD5 c452f3c565c02215b8615b26f61777f0
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4da0526019c843ade96399a33f2a5e9a9d8e415d69859ee8c7874439956c131c

Comments