MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 acc32b0602c183a14026db5cd428a41c65b4817730dc352e1c7c1a1f439627f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: acc32b0602c183a14026db5cd428a41c65b4817730dc352e1c7c1a1f439627f6
SHA3-384 hash: 2bdf838c629cc5a8c3faf09bb970021ef70b687943e65745d0518f48932f0e944014ca0543e9534ea5890e8e20a77b19
SHA1 hash: f9d8bd17d7c708e92a89ee014f542178f905d6d1
MD5 hash: 503a1cd9f1d4a526fa682c82fa54ef8f
humanhash: oklahoma-orange-spaghetti-idaho
File name:Tender For Medical Supplies.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:74'529 bytes
First seen:2020-06-04 06:02:42 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:h7UOfNWZmdD5JA0CHQlGMDspZmlbRMMFoY4d4Z3++ArY7bM+:h7UOfNWh0CwzspAnF3Z3+O7I+
TLSH 7C7312082A33D24C9344AE3A68FC66CE6DB0850D5561F176A75C91B67D223E4F02EFB2
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mails.cesosenintl.ml
Sending IP: 193.142.59.85
From: Ashley <ashley@jaberson-technology.com>
Subject: Fwd: Tender Kampong Bahru - Invitation to quote pharmaceutical and medical equipment for the treatment of COVID-19
Attachment: Tender For Medical Supplies.rar (contains "Tender For Medical Supplies_642020-0723.xlsx.exe")

GuLoader payload URL:
https://qif.ac.ke/komi_yUyfmoyRdV90.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27214.RarHeur.nocdb.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspected-exe-in-RAR.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 03:57:05 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vtbswbqcygb2cqbg3nonikfedrs3jalxgdodklq4pqnb6q4we73a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar acc32b0602c183a14026db5cd428a41c65b4817730dc352e1c7c1a1f439627f6

(this sample)

GuLoader

Executable exe 27faaaca4acb955010d7b8c16764a536c04149f2d332f99668d6ff6f292bfc20

  
URLhaus
https://urlhaus.abuse.ch/url/365819/
  
Dropping
MD5 8372d11946eb3897d7ca0959bd434fac
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 27faaaca4acb955010d7b8c16764a536c04149f2d332f99668d6ff6f292bfc20

Comments