MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88ad92669dfc68f9ef1b4845163d0d70ff2d6c74cf657b74a3caeee99db251b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88ad92669dfc68f9ef1b4845163d0d70ff2d6c74cf657b74a3caeee99db251b5
SHA3-384 hash: 0c1da6727cce0de7e7ccb7bf3c0d158ff9cc2b52242b3b7e57eeae08926e5d8ef03f720116d7747726b7646afd6a7b8f
SHA1 hash: a493cfb1968be5a4b6b259ea4c1729ab0dcde895
MD5 hash: a63f1bf04a1b7c0990ea4ba28d760b52
humanhash: carolina-pip-kansas-orange
File name:PO225678_3356723-2020.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:25'756 bytes
First seen:2020-05-21 08:49:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:P2m9erPNqtyxxkkJ9IAMPSz2OjIWcWqesEIRvx+mqf0C3ynI1h52GkQngkVs7:Om9erPc4RJ9u4RDIRvQZf0CGI17VR+7
TLSH CFC2E143CF2D01997B87E25E8E31FE57884CA9421E0B4385F1FDEA91E24DCE6D0857A4
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: luxasia.com
Sending IP: 156.96.59.92
From: Mr.Lee wang<careers@luxasia.com>
Reply-To: legitworld04@gmail.com
Subject: PO:225678_3356723 TREAT AS TOP IMPORTANCE
Attachment: PO225678_3356723-2020.zip (contains "PO225678_3356723-2020.exe")

GuLoader payload URL:
http://anakleather.ir/som/gozman_YlWSFLtM108.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.FareitVB-AB.21228.5649.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 09:36:32 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rcwzezu57rupt3y3jbcrmpinod7s23duz5sxw5fdzlxothnskg2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 88ad92669dfc68f9ef1b4845163d0d70ff2d6c74cf657b74a3caeee99db251b5

(this sample)

GuLoader

Executable exe 98b8466b7e210fb7867622725cf84b471daa8f037f11530cb831005896842c61

  
URLhaus
https://urlhaus.abuse.ch/url/365793/
  
Dropping
MD5 0d3909095a7321ed0bd29440a3734391
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 98b8466b7e210fb7867622725cf84b471daa8f037f11530cb831005896842c61

Comments