MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9bca27cf6f62fdfabcac46798f52c34d7f8b576de73e3ea7c1cb85aac07f0df5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9bca27cf6f62fdfabcac46798f52c34d7f8b576de73e3ea7c1cb85aac07f0df5
SHA3-384 hash: 7eb8aacbdb864d4b20983c07d832ed4f0615e9f6ab6d5bd284e22786501faf4935f1b0d3989acbfe0234b47d43dca905
SHA1 hash: 9dfecb9471de40c13d8512735ffaf6b74ec88e10
MD5 hash: 1f8f713697dcb934b4be04f66129c9e3
humanhash: princess-london-missouri-illinois
File name:Factura.pdf.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:53'638 bytes
First seen:2020-05-28 07:04:38 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:dMSM3h4PzJs06ILfg+oZG3UqQ8SYKOOnSco:+xi9s0hfv1kqQpLOOnSco
TLSH 5A3301371508CB0F7B41BB805B5E7110C57BB9FA27ECEE88D6E4444B279962B2275298
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: relay1.grserver.gr
Sending IP: 185.4.132.176
From: Admon <victor@contenedoresortiz.com>
Subject: PAGO DEL SALDO
Attachment: Factura.pdf.rar (contains "Factura.pdf.bat")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1-NwXN7u0VxlSYDCEBOZnDmScTdT-JtTp

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 07:37:50 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 9bca27cf6f62fdfabcac46798f52c34d7f8b576de73e3ea7c1cb85aac07f0df5

(this sample)

GuLoader

Executable exe b5382684cba90f427975d7be5c938b3216b38f0f00e617f36c71535e4deb8059

  
URLhaus
https://urlhaus.abuse.ch/url/370263/
  
Dropping
MD5 cc3a34a1998ee0f2192ccef0c2293ea6
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b5382684cba90f427975d7be5c938b3216b38f0f00e617f36c71535e4deb8059

Comments