MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1b9b7053609a995a94295c403fdd3b9f9c1130de9596a38a7c53e668c587a12. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1b9b7053609a995a94295c403fdd3b9f9c1130de9596a38a7c53e668c587a12
SHA3-384 hash: 5c0fdbdd7f56fdea11f1e5a87290a4ddf5bad4d61798a052bcb7822a698080b1c86556544a48919fd9203bf17678c8ae
SHA1 hash: 7410f869aa93851b13bd2b4dde2f5dd6c19ae6c3
MD5 hash: ef9f55e1f08bfc37e053d1ead1144368
humanhash: river-cup-shade-massachusetts
File name:DHL733918737WA.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:29'112 bytes
First seen:2020-05-21 16:06:56 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 768:o1yeLALeR2oxFmhHzSH+nMeriPPHVi+0RqIuO1:NeGo2oxFiHzSY6PB0RqIus
TLSH 31D2F1F823037B1C82165BE0552352C8E65DEFDCCD2675B13BF400896D91F9ED6628AB
Reporter abuse_ch
Tags:arj DHL GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mxload.webglobe.sk
Sending IP: 212.57.32.40
From: DHL Customer Support <esivakova@mlproduktion.sk>
Subject: Consignment Notification: You have A Package With Us
Attachment: DHL733918737WA.arj (contains "DHL733918737WA.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=13VlSA2LUc-TOPJnEHm6KHB4pFEOuvUSi

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Ursu
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 04:00:10 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

arj b1b9b7053609a995a94295c403fdd3b9f9c1130de9596a38a7c53e668c587a12

(this sample)

GuLoader

Executable exe 7556ace3bd8a035ca289145f068029f6137fe41f935b32fd1d0b046d1f2e05ab

  
URLhaus
https://urlhaus.abuse.ch/url/366261/
  
Dropping
MD5 449e962fff13537f4f84132271fe9b36
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7556ace3bd8a035ca289145f068029f6137fe41f935b32fd1d0b046d1f2e05ab

Comments