MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81656a4539c845d47deaa2db58d25fcc562caa98848ebd078891bbb69eb08ace. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



GuLoader


Vendor detections: 5


Intelligence 5 File information Yara Comments

SHA256 hash: 81656a4539c845d47deaa2db58d25fcc562caa98848ebd078891bbb69eb08ace
SHA3-384 hash: cf7dbe2903007c8706b22251176f47806b39b52f1ec6bd63dde2fa38ab166230ed63ac195f4f5ef09bef70d5c0cfbaec
SHA1 hash: 7418f1acec1bc16d3865d6560a30a766c5bdd644
MD5 hash: c20c4bff192cc874883325ee9e3a9295
humanhash: papa-winter-wisconsin-low
File name:PO112000891122110.rar
Download: download sample
Signature GuLoader
File size:23'739 bytes
First seen:2021-02-23 12:53:54 UTC
Last seen:2021-02-23 12:54:21 UTC
File type: rar
MIME type:application/x-rar
ssdeep 384:p6m4PgGptOeALLLO9z3JLg8xULXIcDO4q3zklpvorEHJLBF/mk3NcN7B9CpkhQ+:t4YwONLOz3Ce0XIcq4huItF/myOdwh+
TLSH A6B2E03B80301703CBAA33181E1BEA04D9343FF9503173C5A977AC59A9AAA75D252C7F
Reporter @cocaman
Tags:GuLoader rar


Twitter
@cocaman
Malicious email (T1566.001)
From: "Melissa Parkes<info@basewelding.com>" (likely spoofed)
Received: "from basewelding.com (unknown [139.28.36.99]) "
Date: "23 Feb 2021 11:43:44 -0800"
Subject: "Purchase Order PO112000891122110"
Attachment: "PO112000891122110.rar"

Intelligence


File Origin
# of uploads :
2
# of downloads :
54
Origin country :
US US
Mail intelligence
Geo location:
Global
Volume:
High
Geo location:
CH Switzerland
Volume:
Medium
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
Win32.Trojan.Malrep
Status:
Malicious
First seen:
2021-02-23 04:06:32 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
15 of 29 (51.72%)
Threat level
  5/5
Threat name:
Legit
Score:
0.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 81656a4539c845d47deaa2db58d25fcc562caa98848ebd078891bbb69eb08ace

(this sample)

  
Delivery method
Distributed via e-mail attachment
  
Dropping
GuLoader

Comments