MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ff7e5184e349e5a053a19c70e1dd40aef50e98f0e1f3b42ffa2078e59e78320. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ff7e5184e349e5a053a19c70e1dd40aef50e98f0e1f3b42ffa2078e59e78320
SHA3-384 hash: 781a6da144647e82c52cba2f0d696971675f54ad87ac837541f8823c0b1ae801b5e90783f729cb1795a18c7bb733c8e4
SHA1 hash: 8c9de20ccb558a864d9fd47bd717eb3a77db1e0d
MD5 hash: b60ca34216f7d5e1f5df747658333e25
humanhash: comet-connecticut-pluto-sixteen
File name:Request_for_Quotation_Decanter_00223.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-27 17:27:15 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:S+w44OPvf6Tnkw7y6AqnSURHpKGHLYsLewaS0sh2pDrRl0TCJZKpJdKclrSAa:+Ii7U6AqVgvsB0tJrUCJNT
TLSH CE45E81376D09CB2E8358FF108B29B655D32BD2969114F07764DBF1F2B37AC91A9032A
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server.ecomotorhk.com
Sending IP: 162.144.56.225
From: Batgerel Odsuren <odsuren.batgerel.me2@eng.nssmc.com>
Reply-To: odsuren.batgerel.me2@eng.nssmc.com
Subject: Request for Quotation of Screw Decanter Centrifuge_CE1 Project/AA167194000000 (Muhan Technical)
Attachment: Request_for_Quotation_Decanter_00223.img (contains "order.exe")

GuLoader payload URL:
http://185.94.191.88/bin_qNQJqzF250.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.879400.5326.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 12:56:01 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 9ff7e5184e349e5a053a19c70e1dd40aef50e98f0e1f3b42ffa2078e59e78320

(this sample)

GuLoader

Executable exe 83c07662096e054ff35d85892e828e2f4127015e0d940e88c3c0cf30ac655bc7

  
URLhaus
https://urlhaus.abuse.ch/url/368753/
  
Dropping
MD5 dee8617d13111713a7d434f17a347fb8
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 83c07662096e054ff35d85892e828e2f4127015e0d940e88c3c0cf30ac655bc7

Comments