MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57a93768ea62ff93909249dc8008c570a14d7f19064a953ba31cd80e306ac10b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 57a93768ea62ff93909249dc8008c570a14d7f19064a953ba31cd80e306ac10b
SHA3-384 hash: f56f33ca66497ce2cfd84a22cf08e9dc25ef46d05b1ed792dc34b9c3ecffa0eb3dbfe3c2b502a3854fc3639f326fd2d8
SHA1 hash: daf31d115d739df6e0a6e35c5acdf2a7d216ca69
MD5 hash: d7981e782848b3fa4c16d6a0f8386d17
humanhash: finch-oxygen-item-wolfram
File name:PO-W9087.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:94'154 bytes
First seen:2020-06-02 11:18:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:48QlAtbRy+lzf79zm5oWcsVaCt5X0E9R8QlAtbRy+lzf79zm5oWcsVaCt5X0E9P:s4Rlz79soWXMDa4Rlz79soWXMDi
TLSH B893F2598CEB3413C610104C3F4FE8A09D5A8C42FEB9E8791325AF6E95D79878F089F9
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: slot0.mepsystams.com
Sending IP: 45.95.168.232
From: salexportor@hotmail.com
Subject: AW: Quote Attached
Attachment: PO-W9087.zip (contains "RTF-W002.pdf.......................................................................pif")

GuLoader payload URL:
https://conveyancing.pro/wp-admin/js/widget/w_NEzAtB21.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Nanocore-7995240-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vbkrypt
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 11:37:19 UTC
AV detection:
21 of 47 (44.68%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k6uto2hkml7zheesjhoiacgfocqu27yzazfjko5ddtma4mdkyefq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 57a93768ea62ff93909249dc8008c570a14d7f19064a953ba31cd80e306ac10b

(this sample)

GuLoader

Executable exe 9be235495bd4696901a7e0538b3d96f6996268c67c1b607cdc8e33a794a6a9da

  
URLhaus
https://urlhaus.abuse.ch/url/374180/
  
Dropping
MD5 65f35c2b665a5e6557363bfd54ec32c4
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9be235495bd4696901a7e0538b3d96f6996268c67c1b607cdc8e33a794a6a9da

Comments