MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77746fe2e2ff0aa3847fd302c00b5587ee44dd4fcc5a594b7a913453748fdedb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 77746fe2e2ff0aa3847fd302c00b5587ee44dd4fcc5a594b7a913453748fdedb
SHA3-384 hash: 00bdb0bf213d98779a6396503dd25dc6463b20c284240b6e57e17d94fdb27fc605565aabeacd1b5aaa0a7ef7594de21e
SHA1 hash: 47bcd0696bce22e48b876c5e037103b9e24da683
MD5 hash: e58e44522e359ff606c137dbd907f3c0
humanhash: edward-diet-romeo-king
File name:72435TH.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:34'637 bytes
First seen:2020-05-26 09:02:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:s/kvicJCmN5nhfPg5IxYkJkRRVQeRflKKRdlbUAr8PDH:sWvJVNPg5SKRXpzZUuAH
TLSH 81F2E11359404B3FBDAD4DF34B1A347874E06368E17F6A86AB572A26CC9F1487F21398
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: hal-lndia.co.in
Sending IP: 79.124.8.209
From: Yulia Shingo<sales@hal-lndia.co.in>
Subject: Request For Quotation(June Order)
Attachment: 72435TH.zip (contains "Sternberg.exe")

GuLoader payload URL:
https://nenostore.com/wp-admin/zxtryou_zjzqK240.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Graftor
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 09:37:04 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 77746fe2e2ff0aa3847fd302c00b5587ee44dd4fcc5a594b7a913453748fdedb

(this sample)

GuLoader

Executable exe 98e39e47ec64b976114a4a5b155a057c89222e9e282317e29bbd106e59779b41

  
URLhaus
https://urlhaus.abuse.ch/url/368733/
  
Dropping
MD5 07b24da266429e99f9e91b1fedae43d5
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 98e39e47ec64b976114a4a5b155a057c89222e9e282317e29bbd106e59779b41

Comments