MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5785a5c457cbb9ea804860f360d79b46c6f5bafa472229b7e1fdef13433161a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5785a5c457cbb9ea804860f360d79b46c6f5bafa472229b7e1fdef13433161a
SHA3-384 hash: 4cc86a2221b35ec4c78ad7f313ae7ef41e291400c6a57b4f977fabf1be55620ee9fd5074f972d2c7f2f9da0f954e399b
SHA1 hash: 29d5df1e83d1321e65c64b538bc331934bbcf68a
MD5 hash: b43ca81c095478677f66998a914168cc
humanhash: sink-stairway-neptune-finch
File name:IMG_452947402375.pdf.7z
Download: download sample
Signature GuLoader
Create hunting rule
File size:20'860 bytes
First seen:2020-05-04 04:49:03 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 384:7EaunIth+tQiKGDcOsty1EqWoL0XQBJ+RWRk4lfvOBJ1Rst:knIfnjiYalLMGJ+RWC45eTe
TLSH EA92E1CD5E718B4C417DB0AB65F313BC94463E37500788B07596396E7E2E660E61B363
Reporter cocaman
Tags:7z


Avatar
cocaman
Malicious email
From: Coral Li <sales@dysonservicecentre.co.uk>
Received: from box.dysonservicecentre.co.uk (box.dysonservicecentre.co.uk [104.168.135.236])
Date: Mon, 04 May 2020 02:27:19 +0100
Subject: Quotation Approved // IMG_452947402375 // 04-05-2020
Attachment: IMG_452947402375.pdf.7z

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader33.38732.21162.10597.UNOFFICIAL
Create hunting rule

Win.Malware.Generic-7751004-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 05:35:45 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

7z a5785a5c457cbb9ea804860f360d79b46c6f5bafa472229b7e1fdef13433161a

(this sample)

GuLoader

Executable exe 473f59e503b660f8b9cd8f4a36f955f59cc9b0ee19dec2570d9a907c22df1907

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 473f59e503b660f8b9cd8f4a36f955f59cc9b0ee19dec2570d9a907c22df1907

Comments