MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b424c556dc46aed0946b4e919ba0f0a8905ac7d0a6ff33c82f5e795b6c324fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b424c556dc46aed0946b4e919ba0f0a8905ac7d0a6ff33c82f5e795b6c324fc
SHA3-384 hash: 171f4c0618f5a3cdbca4e59a7083f76edb5cef94f336983761c43bb0906f474c4814c062e88b09ed6dd02d2c55701f92
SHA1 hash: 517fa5752465d9d2602566360dea07510c997fcd
MD5 hash: 73839b60a129ee62c874929024b569ea
humanhash: video-purple-winter-oscar
File name:INVOICE.r00
Download: download sample
Signature GuLoader
Create hunting rule
File size:23'733 bytes
First seen:2020-05-22 10:19:08 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 384:bMjftvdoHQDS7VDbU45TprKqgZoWz0udZuCHmRrAjohu43Fbm+60M/S0TXUeoICt:iDoHmS7VDbUqTprK/Z0uruCHsU0uEoT8
TLSH 8EB2E0392FE6A2922EF13A44B6841788F1474214E3F5C4D5CAB359D72F1B478394E1FA
Reporter abuse_ch
Tags:GuLoader r00


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: seed.net.tw
Sending IP: 139.175.54.24
From: Mauricio Mier <mamier@eldorado.com.uy>
Subject: SIGNED INVOICE
Attachment: INVOICE.r00 (contains "INVOICE.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1czd409N3punnxOPYasYBPh1On5hUEnTu

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Netwire
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 10:37:04 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

r00 9b424c556dc46aed0946b4e919ba0f0a8905ac7d0a6ff33c82f5e795b6c324fc

(this sample)

GuLoader

Executable exe ca9d9bba55a17ac5f0a879efb36f842d2068f0c9844fb8e1285156cfb720d740

  
URLhaus
https://urlhaus.abuse.ch/url/366524/
  
Dropping
MD5 3660289fd74bd36e8acb51ab5b3b94f9
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ca9d9bba55a17ac5f0a879efb36f842d2068f0c9844fb8e1285156cfb720d740

Comments