MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d378955a3343db19bf4014cce0247e7e2084d04c9385b865c5e95002a3257e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d378955a3343db19bf4014cce0247e7e2084d04c9385b865c5e95002a3257e1
SHA3-384 hash: 90a85a638dc2dd54ea33cfc60f250d6950ef41faa2addcbceaa59d107419ed2d9ecf22b826bb7ec8b2eaa91bd015d30e
SHA1 hash: 159cfa332e93a58ed814103a96a3beac6478e679
MD5 hash: 0353ce9ae952595437601b535ee28e89
humanhash: rugby-foxtrot-mobile-echo
File name:Invioice.03000303003.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-12 11:55:39 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:FmkUEG+IC+K/TklnHmcaQSeJRaCAd1uhNRx:FmkaXQRSB
TLSH A2456256BE148136D8A44D711B51EBAD2329BC28D8074E8771C93ECEFFF5AD18E21236
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: tmx.kiev.ua
Sending IP: 91.206.30.205
From: Sharon Hsia<info@marmarayem.com.tr>
Reply-To: <stoh@hansollvina.com>
Subject: AW:AW:Profoma
Attachment: Invioice.03000303003.img (contains "Invoicelo.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.843150.20068.9526.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 12:42:04 UTC
File Type:
Binary (Archive)
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ju3ysvndgq63dg7uafgm4ash47raqtieze4fxbs4l2kqakrsk7qq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 4d378955a3343db19bf4014cce0247e7e2084d04c9385b865c5e95002a3257e1

(this sample)

GuLoader

Executable exe 722c38612f58a2762ae67f38d4342c7aaa59c89c3546cbe0d69f4700b55420fa

  
Dropping
MD5 ebd91cbccb35f5c377bd9cbfd115db86
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 722c38612f58a2762ae67f38d4342c7aaa59c89c3546cbe0d69f4700b55420fa

Comments