MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60a7c828e456f656304107e7cde9138d0fdc0470393825c64b022743491c5904. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60a7c828e456f656304107e7cde9138d0fdc0470393825c64b022743491c5904
SHA3-384 hash: f0696121fdcad28a1916c3ace6bc393eea37d3d1c39be40410cfdc92c51e77824b5f3ee4ef1eeefee21e50dd18ded2f7
SHA1 hash: bfce61ac152a6785c631d59912d7cc2b13b7d6f1
MD5 hash: f3a444f39c60ebb786abfa425654e78f
humanhash: double-comet-finch-charlie
File name:HT_20200522.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-22 09:50:33 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:ef5HO0KF/W/8T7b3Zv7h1FC0SRoInjplerAoOYp:efkTNR3Zv7hrC0+oIjplev
TLSH 9E454A20B2949D65DD818EB2CD665AD512FEBC311D054F0BB68D3B2D2B37A823D2C379
Reporter abuse_ch
Tags:geo GuLoader img KOR


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm35.hanmail.net
Sending IP: 203.133.180.223
From: 이한석 <ldhun01@daum.net>
Subject: 긴급 견적의뢰
Attachment: HT_20200522.IMG (contains "HT_20200522.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1mAQgZjenc9yoRV13wo5A5zN0z8CfVDfP

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Vebzenpak-7866175-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 10:30:28 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 60a7c828e456f656304107e7cde9138d0fdc0470393825c64b022743491c5904

(this sample)

GuLoader

Executable exe 4675be33b1b3f4b1a348a86088a709b907841e6a6daaa37793c0ed994d40f5ae

  
URLhaus
https://urlhaus.abuse.ch/url/366001/
  
Dropping
MD5 6e274d54ed055703c06dd45dcffcac82
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4675be33b1b3f4b1a348a86088a709b907841e6a6daaa37793c0ed994d40f5ae

Comments