MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b29c6124a2bc583de944cd688f5326deb4143b97f721e3748cace62905893769. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b29c6124a2bc583de944cd688f5326deb4143b97f721e3748cace62905893769
SHA3-384 hash: ceb7fc22c4cb55b60412d1306b19eaa15b17a3c88d4efdeaccf95cd02fd240569b90ab71e71bd41a2e10bd1bed7a60e0
SHA1 hash: 77e076b997cf24b4aa2d09a9d0d520c01cb2eec0
MD5 hash: 91fae465ac6b6f215e4fb3e7b8571125
humanhash: bacon-connecticut-fourteen-eleven
File name:New P.O 127845.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:27'385 bytes
First seen:2020-05-25 13:16:59 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:/iKifUI7IXLrPrlSpNKYIGSNGJFnfAb5F7SjiZaFcC:FgUBfiHIGx477g8C
TLSH 06C2E0C3B68D57921BDD4665E26E8A047BB040FF5AE8E90979E8CF5508B4ECA748F042
Reporter abuse_ch
Tags:GuLoader Outlook rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: NAM11-CO1-obe.outbound.protection.outlook.com
Sending IP: 40.92.18.62
From: miriam de gomez <miriamsita_gv@hotmail.com>
Subject: Re Re: New PO
Attachment: New P.O 127845.rar (contains "New P.O #127845.exe")

GuLoader payload URL:
http://ratamodu.ga/~zadmin/iclient/sean_SgXXorh87.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 13:37:01 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
15 of 48 (31.25%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar b29c6124a2bc583de944cd688f5326deb4143b97f721e3748cace62905893769

(this sample)

GuLoader

Executable exe c6aeb4ac138f69e967b712ddf91b7d5b2339e3a97d4fce6f7d48379745e2cb2e

  
URLhaus
https://urlhaus.abuse.ch/url/365502/
  
Dropping
MD5 99fa81b4db948649dddb3cf2d63c0300
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c6aeb4ac138f69e967b712ddf91b7d5b2339e3a97d4fce6f7d48379745e2cb2e

Comments