MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1e63aff81b8cda6dcaa65607d96f52e01fe5698fe35b73afcb291bd62488a76. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1e63aff81b8cda6dcaa65607d96f52e01fe5698fe35b73afcb291bd62488a76
SHA3-384 hash: 6fb3b01a70bf560df32cc4ce60773167ddf55584d7aa29008496d322eb6853a561da7e6a4c3ec28a1872100c33d4e10d
SHA1 hash: c33b1f756c41151101de5b56f5fe616ffdd8ef1a
MD5 hash: df1f704213da902594cceec3a77a2347
humanhash: saturn-fifteen-lemon-purple
File name:E2020-175467.z
Download: download sample
Signature GuLoader
Create hunting rule
File size:432'715 bytes
First seen:2020-05-12 16:18:13 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:LdcnUqJ4FYxNy76BQGE7iK8HhKOcJPt3CNbh985:Lti4Fn2E7QBKF381O5
TLSH D794236EF3DDE61C4A8310B7985C0866E40EC2E927B1E36C9F81BDE5C65A21A45E1B48
Reporter abuse_ch
Tags:GuLoader z


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server0.aratirma.com
Sending IP: 104.168.136.3
From: Angela, Yang <sales@aratirma.com>
Subject: order 175467
Attachment: E2020-175467.z (contains "E2020-175467.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 16:37:08 UTC
AV detection:
18 of 45 (40.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=whtdv74bxdg2nxfkmvqh3fxvfya74vuy7y23oox4wki32ysirj3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

z b1e63aff81b8cda6dcaa65607d96f52e01fe5698fe35b73afcb291bd62488a76

(this sample)

GuLoader

Executable exe 1d3e3896303994f755fcaa5c1e4e699f6453bf9e080851f994e658fc95482333

  
Dropping
MD5 cbcffb4f8cf376f67d7e5569a775c0b5
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1d3e3896303994f755fcaa5c1e4e699f6453bf9e080851f994e658fc95482333

Comments