MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ea3a880de4fbe0e6de406094fdd861c867682793e37c60b6d060b1b595263c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ea3a880de4fbe0e6de406094fdd861c867682793e37c60b6d060b1b595263c8
SHA3-384 hash: cd0c1096b289b98fc840bbea84383ec4137ec1beeee04e4525c3bd3bbcc512f12306271400fa35de1715078749972895
SHA1 hash: 7d66696a782358fc45074ee0d9318632e7869152
MD5 hash: cf65484543acc81d621f2a2222286d35
humanhash: white-missouri-south-tennessee
File name:DHL invoice USDEFI001454105.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:84'469 bytes
First seen:2020-06-04 15:54:51 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:ZrQVvIkMzy8MlVbnaqXnKLcX76EnWkJLMqhvvz05oKRK/PXHX9W8iHKi1WZnYTO:ZG+zjunaq6E7jW6Mqho5oKRif3AHq4gF
TLSH 4383126B0A56DAB913D66133BDD12933437C92C493C8C1A3C259609801CBAD2DFA7EFD
Reporter abuse_ch
Tags:DHL GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mails.cesosenintl.ml
Sending IP: 193.142.59.85
From: The DHL MyBill Team <track@dhl.com>
Subject: Your latest DHL invoice : USDEFI001454105
Attachment: DHL invoice USDEFI001454105.rar (contains "DHL invoice USDEFI001454105.exe")

GuLoader payload URL:
https://qif.ac.ke/kayP_zzZBumFpCL90.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 16:36:36 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l2r2rag6j67a43peayeu7xmgdsdhnatzhy34mc3nayfrwwksmpea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 5ea3a880de4fbe0e6de406094fdd861c867682793e37c60b6d060b1b595263c8

(this sample)

GuLoader

Executable exe 639c28cc97accffb8a92a13ad5056da2a739421ef4965e768fa57356a6685d19

  
URLhaus
https://urlhaus.abuse.ch/url/365990/
  
Dropping
MD5 5c71ea0375eb371b01f2e4aac6e40d26
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 639c28cc97accffb8a92a13ad5056da2a739421ef4965e768fa57356a6685d19

Comments