MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab5de4be72cc99fb490279bacdb83a9ff51f297eb4fe7bb13481d45269dfe0ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab5de4be72cc99fb490279bacdb83a9ff51f297eb4fe7bb13481d45269dfe0ef
SHA3-384 hash: cd35c73cd28a99cb55f8518cae3388f8438036acaf5ae40c6abe3b4dd1bb9ab3a5479f66917e1d1dcffbece37d8d86d7
SHA1 hash: 39ed79e72f69ba36d1d4e77cd7b9596d8e0c0476
MD5 hash: 2ad921495fb3a590cb5f5c0b1a78791f
humanhash: kentucky-hamper-eleven-mike
File name:2 RFQ Request Order JUNE 2020 TT98949878820899999948943889834.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:43'998 bytes
First seen:2020-06-08 14:48:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:WG0P2uD+ZRaAG7F4GhoRg2pwDYrV1iBvKdZxvMF/oUJmgiUo9q0:j0+uqaNl2nhbdHkF/rXa
TLSH D41302F6CE3AE95F7C8C205FE62792A441D155710D393FD2A7AA76E580038FE291C4A2
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: biz0.planete-import.net
Sending IP: 185.255.130.188
From: Ali ÇETİN <contacts@planete-import.net>
Subject: 新项目订单紧急 birusezyllever Request New Order JUNE-YYNBHHGBAOI/ TT#
Attachment: 2 RFQ Request Order JUNE 2020 TT98949878820899999948943889834.rar (contains "RFQ Request Order JUNE 2020 TT98949878820899999948943889834.exe")

GuLoader payload URL:
http://naturepack.cc/files/bin_ArPodh112.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Spyware.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 14:50:10 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vno6jptszsm7wsicpg5m3ob2t72r6kl6wt7hxmjuqhkfe2o74dxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar ab5de4be72cc99fb490279bacdb83a9ff51f297eb4fe7bb13481d45269dfe0ef

(this sample)

GuLoader

Executable exe cb62c35fede3c3b21e2d23591e557962491698c6b834ff03f0a42cf714cc2f24

  
URLhaus
https://urlhaus.abuse.ch/url/364770/
  
Dropping
MD5 f8c560a0ed5091b4a242b9cdd42d6fe6
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cb62c35fede3c3b21e2d23591e557962491698c6b834ff03f0a42cf714cc2f24

Comments