MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 624d1c581c394d6abb299b99690a927403e79bdb59a435bc0fd48989eba41a9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 624d1c581c394d6abb299b99690a927403e79bdb59a435bc0fd48989eba41a9a
SHA3-384 hash: 9ae3e2ae85e42648726743637de1178b9b4e9687d0b8c3415ecf5f2accf3a94f03a0eac3af6c485d5f34fbd237027b71
SHA1 hash: d0104f5ed22a27b7abcc3e877feff7d97fde940c
MD5 hash: 7116cc98d5965ed92f89db1aa3434bd0
humanhash: jersey-beryllium-spaghetti-berlin
File name:efax message.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-26 07:33:31 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:NwNxV8ZFs66KTd/2u34eCBguxDlj5SoyS:+jV8M66KZ+uLCBguxxr
TLSH 0845D64676E8AC95ED022EB11FD0AA751E32BD212DB08F47B44FB71D2B371989FE0614
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail.emerjoin.org
Sending IP: 213.136.88.15
From: efax Payment <support@uxsouthafrica.com.demo.emerjoin.org>
Subject: You have 1 New Fax Message
Attachment: efax message.img (contains "efax message.exe")

GuLoader payload URL:
http://185.205.209.166/wext/Rem-Stub23_lNdKRpB81.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 13:47:14 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 624d1c581c394d6abb299b99690a927403e79bdb59a435bc0fd48989eba41a9a

(this sample)

GuLoader

Executable exe 86df8967bdd2d2f92df86193d138e2e4c15957e091644e2efef7687de49b6c02

  
URLhaus
https://urlhaus.abuse.ch/url/367079/
  
Dropping
MD5 d1d7fe9513042f9f80ea48d365ab33bf
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 86df8967bdd2d2f92df86193d138e2e4c15957e091644e2efef7687de49b6c02

Comments