MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab845d178869111f5ee2a8967ddfef0ee1f13f6f0a5134028b2d107ae4a4fe22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab845d178869111f5ee2a8967ddfef0ee1f13f6f0a5134028b2d107ae4a4fe22
SHA3-384 hash: 4cee673def9e04eea68d7b57a9133f0a1841153993dac763e85badecaab7921a507767d16fe5ac74c278d46e9291893e
SHA1 hash: 68429d5dab46562f26f1f4713c5929456d9e4c62
MD5 hash: f70c731573fbbacdeecb1e7f07df5c77
humanhash: mike-september-crazy-friend
File name:PO260520_pdf.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:34'631 bytes
First seen:2020-05-26 11:21:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:liDSywqIuzC6EbIdO+DSk90nN8Rhw6wZl6jJHouaL9PTUHz3OmmNZ:MeVqIYxEbIHmkiqZwfoZ9aL9Pgtg
TLSH E2F2F1C919BCF109EECE13BC81F8D1E7AA72DAFA31B661DF58D30D3459A99464746C00
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: m13231.mail.qiye.163.com
Sending IP: 220.181.13.231
From: Sales <fuwubu@techmoris.com>
Subject: New Order (Urgent)
Attachment: PO260520_pdf.zip (contains "PO#260520_pdf.exe")

GuLoader payload URLs:
http://legalpros.lawyer/stuees/biggrc_JbGnQQX110.bin
http://keno-eneryg.com/stue/biggrc_JbGnQQX110.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23581.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 11:37:07 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip ab845d178869111f5ee2a8967ddfef0ee1f13f6f0a5134028b2d107ae4a4fe22

(this sample)

GuLoader

Executable exe c52ca2d3f581c0f1149d3538a985bb896755356d0c00abc546c142accaf0015d

  
URLhaus
https://urlhaus.abuse.ch/url/368807/
  
Dropping
MD5 917c3af3662f454a377e453eeba29d7e
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c52ca2d3f581c0f1149d3538a985bb896755356d0c00abc546c142accaf0015d

Comments