MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f98ce61abb190828de566e219c83d424bd8598864094e701455b255828967b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f98ce61abb190828de566e219c83d424bd8598864094e701455b255828967b6
SHA3-384 hash: e79caa0c9fcfaa171a3f4d18e56527a8486d1f56fe1f1cf490b18064a2c821204537846f85c84e087dfae4ba09ec0675
SHA1 hash: bc621302a70e575bcd8210b3e4c8adeb4effc166
MD5 hash: 8797fd0e203725c47e17b6dd1e5977a6
humanhash: equal-fanta-bakerloo-london
File name:Payment Advice.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:24'524 bytes
First seen:2020-05-04 20:46:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:Dc+gRWdxoCZHnuAZaNjBprQrP1stHjeVfSwVguiHJoXOlUkwz93+UH83j/mSOY4I:4+gRmxoCRnVaNDAKHjeswVkpBUkwpOUM
TLSH 76B2E10DB01F769DB0A6DB18BD03545084F9673A6315E73BE8A97EBE5C6C49E330E062
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: pleskl36.axarnet.es
Sending IP: 91.142.210.104
From: Liu Ying | Hofmann Chemie GmbH<expedition1@hofmannchemie.de>
Reply-To: <expedition1@hofmannchemie.de>
Subject: AW: SHIPMENT ADVICE/ PAYMENT
Attachment: Payment Advice.zip (contains "Payment Advice.exe")

GuLoader pushing Loki

Loki payload URL:
http://castmart.ga/~zadmin/xcloud/gold_TtBaWDj152.bin

Loki C2:
http://allenservice.ga/~zadmin/lmark/gld/link.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.44213.9459.24962.UNOFFICIAL
Create hunting rule

Win.Trojan.VBGeneric-7750994-0
Create hunting rule

Win.Malware.Generic-7751004-0
Create hunting rule

Sanesecurity.Malware.20774.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 04:03:24 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p6mm4ynlwgiifdpfm3rbtsb5ijf5qwmimqeu44aukwzflaujm63a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 7f98ce61abb190828de566e219c83d424bd8598864094e701455b255828967b6

(this sample)

GuLoader

Executable exe 9059531fbff89a14fc3761330cac92437bee44349e6b62e7e807422b4c57e2fe

  
Dropping
MD5 aca370cb867228cb76446a8c1caa9de3
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9059531fbff89a14fc3761330cac92437bee44349e6b62e7e807422b4c57e2fe

Comments