MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a89513ea9aed78fccbb98daecf9b3d985c48158e0b9d42ca9861af303aaf2b92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a89513ea9aed78fccbb98daecf9b3d985c48158e0b9d42ca9861af303aaf2b92
SHA3-384 hash: 112bbcb8b243b9e5dc3d8a4193c2556395fa67f90729b14a5264c7f348aa144b07f40317ec10cd8712a3d7cb0c4e9c39
SHA1 hash: bd1948e0512b9c5637cb2f49ee50f68cb7e45840
MD5 hash: 2531ddb456225a073eaf546b28cec7c8
humanhash: earth-nuts-monkey-florida
File name:Outstanding Invoice_9389373_05_2020.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:26'521 bytes
First seen:2020-05-22 10:12:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:VmHwJmYsnsh3zc5wbFplEWG2Lbj+hlM/SIiG3:VOwJ5tbFD7Lbj+hOSI53
TLSH E6C2E00B1B0F2911E30C6C4EA135F0262BE6BE4D11EFE9ED35D896C2A21D4005DAB23F
Reporter abuse_ch
Tags:arj GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail.nwiran.com
Sending IP: 185.94.98.43
From: UTLX METAL WORKS Co. <info@kts-me.com>
Subject: Invoice Confiirmation prior to Payment
Attachment: Outstanding Invoice_9389373_05_2020.arj (contains "Outstanding Invoice_9389373_05_2020.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=16pdtfZQsIuTKlvUWbPTFf7qt38rdyUVy

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Malrep
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 10:37:07 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip a89513ea9aed78fccbb98daecf9b3d985c48158e0b9d42ca9861af303aaf2b92

(this sample)

GuLoader

Executable exe 85efd0b4c3bb6232c4e075e99c46574b564785b0bdfa1b8bd91805922d91cef3

  
URLhaus
https://urlhaus.abuse.ch/url/366485/
  
Dropping
MD5 7725a1f2e59b447390de5772323d6e05
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 85efd0b4c3bb6232c4e075e99c46574b564785b0bdfa1b8bd91805922d91cef3

Comments