MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49666fc20961858334a5a4a460299909c9a558d3b6547d6f5842099ccb4ecd80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49666fc20961858334a5a4a460299909c9a558d3b6547d6f5842099ccb4ecd80
SHA3-384 hash: b6e6a205cddf924fc51213cdaf689deee8d54f77df9e32c72724f48d8137eb20686af99f1d61a89a21ffe78f61a7343d
SHA1 hash: 06fc0912ed732493b942c1cf67dced5459770fc3
MD5 hash: 20fdc5eb5684a93526ae65aeae2975d4
humanhash: vermont-fix-blossom-five
File name:doc08765498_pdf.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:32'388 bytes
First seen:2020-05-26 09:02:34 UTC
Last seen:2020-05-26 12:18:53 UTC
File type: gz
MIME type:application/x-rar
ssdeep 768:KFaXVRhiE/nz5/zyQB/irdJXr2E8LkjgjLp4FSFJCRHHcpp:KArhiE/V/3mj2E8LiepMWJycpp
TLSH ABE2F17EE18A4388F2F175799EE9326D14B3493F472A2940014F9AF43D8503EF79368A
Reporter abuse_ch
Tags:GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: noni.com
Sending IP: 216.127.167.28
From: Tien, Le Thanh (Mr.) <ops2@daivicontrol.com.vn>
Subject: PO: JGN2004000036.
Attachment: doc08765498_pdf.gz (contains "PILLDATAPOI.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1hTs9WxQncmGtZ1khx0m_Uk6rYw89tFtL

Intelligence

File Origin
# of uploads :
4
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Frs
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 09:36:49 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 49666fc20961858334a5a4a460299909c9a558d3b6547d6f5842099ccb4ecd80

(this sample)

GuLoader

Executable exe 70e8b249ce476ea3ff1c233de9eef9b9f1e2ad1da22c1bb3e16acc20eaa0e9a2

  
URLhaus
https://urlhaus.abuse.ch/url/368719/
  
Dropping
MD5 f3551d499416bf2a7e9affc59dd6ac5e
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 70e8b249ce476ea3ff1c233de9eef9b9f1e2ad1da22c1bb3e16acc20eaa0e9a2

Comments