MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52f003cef4260cdf48d34bda08059bb2699144969f521812444c20531d5823af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52f003cef4260cdf48d34bda08059bb2699144969f521812444c20531d5823af
SHA3-384 hash: 418613da17f6583d1cb8a4e358fede1da9fef4450c405b16c3f018ae76177802cc193ca1db83c749ef85f222bf2ea7d7
SHA1 hash: f578d36924caa59783a9d41dd3af784a83babdcf
MD5 hash: c4b488174316ff163f0da29e241f8edc
humanhash: jupiter-cup-victor-potato
File name:Ensto Purchase.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:28'691 bytes
First seen:2020-05-23 11:52:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:FfTDQ+HDFwgkyNQbt01hXFAIm9Z+9RS895qO:1oqwpyih01hGIwZ0RSY
TLSH 41D2F19107FCD7F12287542CD7F2759E6D6A404620FF69C2FA0825D16C3CE4B8587A4B
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: ensto.com
Sending IP: 37.49.230.137
From: Sales <stefan.balund@ensto.com >
Subject: Ensto Purchase
Attachment: Ensto Purchase.zip (contains "Ensto Purchase.bat")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1DB2cV-n7_vqcC13rrW4gY9RnpxUFSlVl

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.generic.ml.19427.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-23 12:36:24 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 52f003cef4260cdf48d34bda08059bb2699144969f521812444c20531d5823af

(this sample)

GuLoader

Executable exe 74cfeab3123defd40a4efa419fcc77b17178c27b3b70b97972939f7a8d899957

  
URLhaus
https://urlhaus.abuse.ch/url/367158/
  
Dropping
MD5 fd972edaa3cd3f41b6e3114e4a92b811
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 74cfeab3123defd40a4efa419fcc77b17178c27b3b70b97972939f7a8d899957

Comments