MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6afa5374e2759faac39a03f832729eb174af5fca53415ac98bb32ba74a33e6bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6afa5374e2759faac39a03f832729eb174af5fca53415ac98bb32ba74a33e6bd
SHA3-384 hash: 507e9567b5e4e977049d675821fa959dada113188ce6890261284507bc7afaf79e17c165c87abf47b9844d23d22cf441
SHA1 hash: 81582be9f611698eaab0e3e0032963bc81ab4a08
MD5 hash: a3c7a81fc44f16026d2703fa2f958430
humanhash: beryllium-sodium-south-music
File name:PLanilla deFacturacion Mensual 2020.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-26 13:44:47 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:ctcH/mh6dhVretAtiyHU4mTVQ9N8ZvOj:cU00PrwAtTeU
TLSH C045D81379A48D73E92C8BB25CF295905D7AEC5079520B03368DF66D3B363C66DA430E
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail.strongmailvault.com
Sending IP: 111.90.144.220
From: Julieta Campitelli <JCampiteli@newtral.com.ar>
Subject: PLANILLA DE FACTURACION HASTA ABRIL 2020
Attachment: PLanilla de Facturacion Mensual 2020.img (contains "PLanilla de Facturacion Mensual 2020.exe")

GuLoader payload URL:
http://kuroilersuganda.com/indaboski_IuQSk59.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Gen.NN.ZevbaCO.34122.hm0@a0Y0kJkb.15568.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 14:36:02 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 6afa5374e2759faac39a03f832729eb174af5fca53415ac98bb32ba74a33e6bd

(this sample)

GuLoader

Executable exe 18e748742879005f647c8928a776023d2a11aa865f34b6ee75adfa5a2abfebfe

  
URLhaus
https://urlhaus.abuse.ch/url/369188/
  
Dropping
MD5 1db6b268cfcfb4d76aa9eeff46df8c83
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 18e748742879005f647c8928a776023d2a11aa865f34b6ee75adfa5a2abfebfe

Comments