MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82bb6f708056e9a9910dc48a118bfe57d8f259b76f92082254a6f9e7dc22e861. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82bb6f708056e9a9910dc48a118bfe57d8f259b76f92082254a6f9e7dc22e861
SHA3-384 hash: de3d7da70df3281186a9ce01f8c4ac87a6e1cc58a5136bce1cd687b374e07e46f5d8877d7c1be8b574190d378cb03a36
SHA1 hash: b32d2c0cb23fa237d845e2ad53705a761d8059ed
MD5 hash: 40cb3b5a162f9bfa5c2e856155cb4a7a
humanhash: pizza-triple-beer-nine
File name:Rechnung.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:28'893 bytes
First seen:2020-05-21 10:25:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:aIBP0djPcBS2HY2ka8dQQd/zpCakPdB8juyH/M/B:aIakBXqa8dQ8ir3kO
TLSH 94D2E1F5325711179ABD2AAE2A1A78F51EEFB75A4CDA32CFDCB652A83051877C0500C2
Reporter abuse_ch
Tags:DEU geo GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: cloud415.mxserver.ro
Sending IP: 31.14.13.123
From: cardnational.bn@casbn.ro
Subject: AW: AW: Zahlungsbeleg und Auftragsbestätigung 21-05-20 Rechnung_20-613129926-001
Attachment: Rechnung.zip (contains "ugudeligst.exe")

GuLoader payload URL:
http://156.96.118.179/RSol.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.FareitVB-AB.31267.9542.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 10:36:59 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qk5w64eak3u2teinysfbdc76k7mpewnxn6jaqisuu346pxbc5bqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 82bb6f708056e9a9910dc48a118bfe57d8f259b76f92082254a6f9e7dc22e861

(this sample)

GuLoader

Executable exe e002a7458ce812cec1807f9bb53ea52949b105db60908693365e55cc04d2f6a6

  
URLhaus
https://urlhaus.abuse.ch/url/366085/
  
Dropping
MD5 b612e5199220fd7a0c9af3a4d897f639
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e002a7458ce812cec1807f9bb53ea52949b105db60908693365e55cc04d2f6a6

Comments