MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 590191caee9082c3789cdcd5c4daba2fcf73805b9f8631a3b6f7bd0488da4c9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 590191caee9082c3789cdcd5c4daba2fcf73805b9f8631a3b6f7bd0488da4c9f
SHA3-384 hash: 8146e07c65cd546c2ffc7bcb277a0c35e1cc0c9c7eb97dc75d157bc3c2ef7e4cc2b81eab71489d1b7f7e9e01fe4025e1
SHA1 hash: 3b4ff83c23cff9974de9493fdad3786a17d31703
MD5 hash: b7ce5160936947cee0a782782c1c211e
humanhash: eighteen-iowa-vermont-lima
File name:ups.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-26 07:21:32 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:3b9J/gmpwR7PcaZeqSXs3bZ3+J5b2B6Dx:3rrmR7PhF05
TLSH 77450A1EBDC29CA5E80089B248D1C6501DBBFC725C544F8F708EBB5E1FB67822DB8265
Reporter abuse_ch
Tags:GuLoader img UPS


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: giant-monkey
Sending IP: 112.213.32.15
From: UPS <support@ups.com>
Subject: Dear Customer
Attachment: ups.img (contains "ups.exe")

GuLoader payload URL:
https://www.sendspace.com/pro/dl/8auinq

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Injector.EMCW.5866.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 07:36:15 UTC
File Type:
Binary (Archive)
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 590191caee9082c3789cdcd5c4daba2fcf73805b9f8631a3b6f7bd0488da4c9f

(this sample)

GuLoader

Executable exe 7c808fef514fbb79de397a7c84bd1a2763b3b476c821d7c6f7d05b64501c900f

  
URLhaus
https://urlhaus.abuse.ch/url/368667/
  
Dropping
MD5 ad6230c59d15fd0030facf29d2bd5cee
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7c808fef514fbb79de397a7c84bd1a2763b3b476c821d7c6f7d05b64501c900f

Comments