MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50be24ee32d044487eb5c91c71076299f92dc510209202a89745fb6f62fb853c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 50be24ee32d044487eb5c91c71076299f92dc510209202a89745fb6f62fb853c
SHA3-384 hash: f162171f1f2e35fd76e9ce93e7da7df2cfa1cb10f331668c15d7ff35a83becfde5f2349817286039e3bb5fe72c2f2078
SHA1 hash: 92e5b6592ec23a520b7b688b65738f78bba5e74a
MD5 hash: b90066ed887041c716766d2654c356fe
humanhash: skylark-moon-bluebird-iowa
File name:Wire Confirmation.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:46'561 bytes
First seen:2020-06-02 11:18:00 UTC
Last seen:2020-06-04 05:56:58 UTC
File type: zip
MIME type:application/zip
ssdeep 768:2X47YqlWRMF8hBmdcjFY1ekre7Yv+8AAFJ3c73TpQpjinbWzP1JRJYjr+:2X4E/oSB86Y13rRM73TpQpjigrRmq
TLSH 5B2302757E7933E3145E9D7243A70E8FA06CC6876294C1BF25585E622023978DCC5AB3
Reporter abuse_ch
Tags:GuLoader UPS zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: m1.valueserver.jp
Sending IP: 157.7.184.31
From: Cindy Lopez<123@mayonakalab.com>
Reply-To: <Cindy.Lop@aaglobalimports.com>
Subject: RE: RE: RE:UPS Shipment 779945110T:**WIRE COFIRMATION
Attachment: Wire Confirmation.zip (contains "Wire Confirmation_pdf.exe")

GuLoader payload URL:
http://ratamodu.ga/~zadmin/group/gld_BJLCSDOEDs225.bin

Intelligence

File Origin
# of uploads :
2
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 05:40:56 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kc7cj3rs2bceq7vvzeohcb3cth4s3riqecjafkexix5w6yx3qu6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 50be24ee32d044487eb5c91c71076299f92dc510209202a89745fb6f62fb853c

(this sample)

GuLoader

Executable exe d2669f09cb9d457a0bb1ebc7db59cc0f53778ebf2fbd90f84b7c3fd587a109bb

  
URLhaus
https://urlhaus.abuse.ch/url/373165/
  
Dropping
MD5 341d586e5c01e7bac68d1b41711bccab
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d2669f09cb9d457a0bb1ebc7db59cc0f53778ebf2fbd90f84b7c3fd587a109bb

Comments