MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e4c557e5c5eb1a1bcf33bc19d6ff4388b2753531667d4a58fbb8e740fb0bc6a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e4c557e5c5eb1a1bcf33bc19d6ff4388b2753531667d4a58fbb8e740fb0bc6a
SHA3-384 hash: 15409abc5d963bb241a65701e9c092346e8a1fa15dda89a1f7bfc98ddf3f3c072cd0c18abb134eb1d457bd005fb05d02
SHA1 hash: ed988d85be460de2adfc6382d0bb49b2a340cc44
MD5 hash: d10da4ba1efd5bd7508580b2aaa9b3ef
humanhash: xray-minnesota-paris-oregon
File name:Order.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-22 09:48:32 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:YgNkPxAPfg3AUI4IqkhIkamQHGyuyoFBqq8Zm4wjpYpjys7DTpglaN4mqhoyT:YikxbNk6vHGyuyGB8Z8p4pgoS
TLSH EB452B29F990E86ADD208DF18EA68BD0617BBD2129504F5F348D7F5C2B37D829C6134E
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm35.hanmail.net
Sending IP: 203.133.180.223
From: 한라몽 <wwj1015@hanmail.net>
Subject: 발주서 - (주) 한화
Attachment: Order.img (contains "Order.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1Mo0FJdKXDM2mANnqiFJZcas8J9hW9gBs

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 02:59:50 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 8e4c557e5c5eb1a1bcf33bc19d6ff4388b2753531667d4a58fbb8e740fb0bc6a

(this sample)

GuLoader

Executable exe 0b070208a117d36e1941cacb4d20ce5c9493d9b6357422cf1292dddf1c5a27ca

  
URLhaus
https://urlhaus.abuse.ch/url/366516/,geo,KOR
  
Dropping
MD5 0f02aafb38acc002621c764aac711d39
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0b070208a117d36e1941cacb4d20ce5c9493d9b6357422cf1292dddf1c5a27ca

Comments