MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84633e7f323461a440b861480367948fc481415052648ad05f334f2d876ac63e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 84633e7f323461a440b861480367948fc481415052648ad05f334f2d876ac63e
SHA3-384 hash: 7ee07689265ec90d2ad36858b81c316990759624dfe513f5301a9f06b381b4a0915777b66cb660fbc91df5de28126a40
SHA1 hash: fd8d5460975b66cc1452c5ab8f6c748bd0e79974
MD5 hash: f308265d920a4d5d807c8437e731a126
humanhash: ink-pennsylvania-east-bulldog
File name:PES50406 invoice TSF20010001.pdf.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:30'960 bytes
First seen:2020-05-27 16:46:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:LY1DR+fBGwIbNZpx8hb/H5LSPGju4Tn7xHpY0FJcSFo1Gesng+85Q:LADR+5pSZpSh1mPGjuI7hS0FJ3L2+85Q
TLSH 1CD2F19808D54EF5E1CA54FDBE2C02950FE49A5DCE07D3AE72C4259BD18AFC08F1A623
Reporter abuse_ch
Tags:arj GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mailgate08.ps.kz
Sending IP: 78.40.108.8
From: qaqc2@umirzak.kz
Subject: swift payment confirmation for PES50406 invoice TSF20010001
Attachment: PES50406 invoice TSF20010001.pdf.arj (contains "swift-pdf.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=16_HEi9EIbQ_7YEOXUK6yg7Dgymc7naVU

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25906.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 17:36:58 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 84633e7f323461a440b861480367948fc481415052648ad05f334f2d876ac63e

(this sample)

GuLoader

Executable exe e6c57e2f4dfc204c1e9768a3c722cda303af4795c7272a0b94b308cfe8c9c97b

  
URLhaus
https://urlhaus.abuse.ch/url/369911/
  
Dropping
MD5 e06c5c39d35a0ebafbb3dc1d5e709bc7
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e6c57e2f4dfc204c1e9768a3c722cda303af4795c7272a0b94b308cfe8c9c97b

Comments