MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d76a392d98b23447d29ec1f85b01ed357b48f2ba6ac579fc5f322932efd9be5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d76a392d98b23447d29ec1f85b01ed357b48f2ba6ac579fc5f322932efd9be5
SHA3-384 hash: 12b162dc00c361930ae2da72e1b788dfb3487631b07b9ed332e89557adfa781cd332cfa1ab88c0a2854d89468cc6164e
SHA1 hash: 0108c0f3bfee3429c77f3bcd9cb5293f644c4609
MD5 hash: 5159a4416d06af5fb2cc0b3eec2f16bf
humanhash: dakota-hotel-maryland-colorado
File name:Request for quotation for COVID-19 Products.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:42'323 bytes
First seen:2020-04-20 15:59:15 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:G4aGX9N7MkejziYH1TTh97BwR8jExHwH+FTA5l8fiptxY:GUXDijziYVTNBBwRBlpA5ljpw
TLSH 4513F1CBF622B6D64A35FD1EBF08F879381F19B8AA26740B87D3900B75567355103542
Reporter abuse_ch
Tags:COVID-19 GuLoader rar


Avatar
abuse_ch
COVID-19 themed malspam distributing GuLoader->AgentTesla:

HELO: sau-f9894-or.servercontrol.com.au
Sending IP: 118.127.60.69
From: CHARLES<info@bowersmedical.com>
Subject: Request for quotation for COVID-19 Products
Attachment: Request for quotation for COVID-19 Products.rar (contains "Request for quotation for COVID-19 Products.bat")

GuLoader payload URL (AgentTesla):
https://drive.google.com/uc?export=download&id=1hzN2z26Dl9juRy5b5bfWACeroI-ka7St

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-20 16:35:23 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lv3khewzrmrui7jj5qpylma62nl3jdzlu2wfph6f6mrjglx5tpsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 5d76a392d98b23447d29ec1f85b01ed357b48f2ba6ac579fc5f322932efd9be5

(this sample)

GuLoader

Executable exe 4cd26d79cdab1d9f934cdee769ab7f1803735a120d95afb470a2466a088c4d5c

  
URLhaus
https://urlhaus.abuse.ch/url/346934/
  
Dropping
MD5 4e1300730e16c467e530149ac0569ff5
  
Dropping
SHA256 4cd26d79cdab1d9f934cdee769ab7f1803735a120d95afb470a2466a088c4d5c
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4cd26d79cdab1d9f934cdee769ab7f1803735a120d95afb470a2466a088c4d5c

Comments