MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c1870fc3f54ee278d0892aeb6aee1ded9324ccf96a782a4d1398654bccf0ae3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c1870fc3f54ee278d0892aeb6aee1ded9324ccf96a782a4d1398654bccf0ae3
SHA3-384 hash: 3f4caa6ece75cfb1ad51179ea717ece44bd018d965538d363ab83042aad4b6b61b5482642107c8ec2875ef6089907759
SHA1 hash: 25d2078298d1d1cb3ccdf6e69f301cc2505ae588
MD5 hash: ae6ac3f69c5dfc45ef47cef901b77888
humanhash: harry-north-magazine-nuts
File name:MY10584R0094485MYKUL.pdf.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:29'057 bytes
First seen:2020-05-27 17:34:46 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:Xaf//K2iu0bGiclC+GnWkP16spNKhlKRmtFZln:Xg/kfGPlqLcsAeRALln
TLSH D7D2E06968037B6EE85CA8B00D21AD1C807810659C5397E9A6D324F7F92C7EFDCA7843
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: smtprelay.hostedemail.com
Sending IP: 216.40.44.207
From: Mohsin Ali (DHL PK) <Mohsin.Ali2@dhl.com>
Subject: **TOP URGENT** SHIPMENT REQUEST
Attachment: MY10584R0094485MYKUL.pdf.rar (contains "MY10584R0094485MYKUL.bat")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1a3H3Mx2bknvnzrQAbdE5DTN7t_85E7Uh

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 17:36:53 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 6c1870fc3f54ee278d0892aeb6aee1ded9324ccf96a782a4d1398654bccf0ae3

(this sample)

GuLoader

Executable exe 8f09e2d15730d4a4e19876b7d4f284fe43494e761824081dee255c677630f8e6

  
URLhaus
https://urlhaus.abuse.ch/url/369970/
  
Dropping
MD5 958063b70e8204224fabdb36100de895
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8f09e2d15730d4a4e19876b7d4f284fe43494e761824081dee255c677630f8e6

Comments