MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88caa886b13c0edbf8f0a2ab014184974674d41d8834421863891a666e83432b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88caa886b13c0edbf8f0a2ab014184974674d41d8834421863891a666e83432b
SHA3-384 hash: 972443685ef7cb8513c6d28f464c7ab87b02f1bb076ba1babba6618cd2b5a805813a17bf6f7fe7dc7f7175be736b81f1
SHA1 hash: 76523ed2bc99d1731c80c70ec9aa9fa9b6ed1888
MD5 hash: 45c6238b82258ca4260d7d5107537dc5
humanhash: don-gee-butter-beer
File name:RE NEW PO 4533242.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:28'300 bytes
First seen:2020-05-27 12:57:54 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:9ER8aVjKaUWfNYuOLKu2jCmJ/1sK0TotK9kObP:9ER8aB9qSsmJtsK0TotKSObP
TLSH 9FD2E061626C5FE26D59803365F45FEE782509375B6040AE70FBF7CE98A2E884BC150B
Reporter abuse_ch
Tags:GuLoader Outlook rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: APC01-HK2-obe.outbound.protection.outlook.com
Sending IP: 40.92.255.93
From: Ruwan PATTERN <pattern58@hotmail.com>
Subject: RE# NEW PO FOR may
Attachment: RE NEW PO 4533242.rar (contains "RE# NEW PO# 4533242.exe")

GuLoader payload URL:
http://ratamodu.ga/~zadmin/iclient/sean_SgXXorh87.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 13:36:07 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
12 of 31 (38.71%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 88caa886b13c0edbf8f0a2ab014184974674d41d8834421863891a666e83432b

(this sample)

GuLoader

Executable exe be4614de71b42f1015076a3c708c09f911091333bdca1792450eccddc5ab1484

  
URLhaus
https://urlhaus.abuse.ch/url/365502/
  
Dropping
MD5 56ffb08a4da8f911243e6147024d52e2
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 be4614de71b42f1015076a3c708c09f911091333bdca1792450eccddc5ab1484

Comments