MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 658cea08e0cc26f793c153b83bc24a3ac7d22320e08089798594f54779347f92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 658cea08e0cc26f793c153b83bc24a3ac7d22320e08089798594f54779347f92
SHA3-384 hash: 3ef148d391766be89dd59975e3c081ea9c47626f01c26fe0571ef101f76bd0eda0077340449fbafe83cfdadd94912cc8
SHA1 hash: 175f9f9fd7634c3efa81bb4dc487a7a54462d996
MD5 hash: a35d61c0bdf993ec120c0d8b0f1dc58a
humanhash: winner-december-massachusetts-alaska
File name:PO-COVID 19.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:26'076 bytes
First seen:2020-03-31 07:16:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:LsBgzR0FBOpYi0Xhzxn4nL7Lq2OzwEICC:ASOF2neh94nfL7OzXC
TLSH EBC2E117E6A032BFE8533475015888328E93767E61F8E5C335E4328EF9EABFA0415D55
Reporter abuse_ch
Tags:COVID-19 GuLoader zip


Avatar
abuse_ch
COVID-19 malspam distributing GuLoader->404Keylogger:

HELO: r2.s150.mail1.smtp.beget.ru
Sending IP: 185.78.30.105
From: info@lubcom.ru
Subject: Purchase Order (PO For-COVID-19 Products)
Attachment: PO-COVID 19.zip (contains "PO-COVID 19.bat")

GuLoader payload URL (404Keylogger):
https://drive.google.com/uc?export=download&id=1fILMgZc6MBNGQVrpA3SaVzzEPZ0NFsML

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Remcos-7647550-0
Create hunting rule

Win.Trojan.VBGeneric-7648165-0
Create hunting rule

Win.Trojan.Ponystealer-7648176-0
Create hunting rule

Win.Trojan.Generic-7648215-0
Create hunting rule

Win.Dropper.Remcos-7683428-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Formbook
Create hunting rule
Status:
Malicious
First seen:
2020-03-31 07:35:38 UTC
AV detection:
25 of 47 (53.19%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mwgouchazqtppe6bko4dxqskhld5eiza4cais6mfst2uo6jup6ja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 658cea08e0cc26f793c153b83bc24a3ac7d22320e08089798594f54779347f92

(this sample)

404Keylogger

Executable exe 69962972d8f2dffaefc853e38a71f20b1516d51eae04183ff97f16c722cedf83

GuLoader

Executable exe fe9c4713a117b88c7b1c7adefcafe164cab311dcf6d7a1ae7a9569c9bb65b705

  
URLhaus
https://urlhaus.abuse.ch/url/332172/
  
Dropping
MD5 99543e606c46dce805e8c356522c479b
  
Dropping
SHA256 fe9c4713a117b88c7b1c7adefcafe164cab311dcf6d7a1ae7a9569c9bb65b705
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fe9c4713a117b88c7b1c7adefcafe164cab311dcf6d7a1ae7a9569c9bb65b705

Comments