MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b745c96ae29996cb6c29568f0ed053264d24505c29b29df51d145ece340310ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b745c96ae29996cb6c29568f0ed053264d24505c29b29df51d145ece340310ec
SHA3-384 hash: f45eeb1a88547273a05c5e96f92712dbf6b5c3118d22e6fd001576d6cb9f56ef42f28dccab555d58b4425cf512a983a2
SHA1 hash: f126faa6570661e80d8392a59c83182ba5b50dea
MD5 hash: c9beda8eb59ac0941c1adff327342e2b
humanhash: lemon-earth-music-gee
File name:New Order2030404.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:23'765 bytes
First seen:2020-05-21 08:15:41 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:rkgSoTj+0cfhLKmBWTu030KKX4aRsy4mGbI4Jr50M4hPD3ZmHjMGOKQNhz/U:rtPTj/uhLKmBWT/01X4aRshbIMruZmyM
TLSH D0B2D060B5D715A46C58819ED00F93E0EFAD56A3E34560E1102F3BCB1E89357EB92B37
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: sta.staunchvaluededicated.com
Sending IP: 162.214.70.141
From: Ning Rose - Sales02 <shaylee@rossnriley.us>
Subject: Purchase Order 2020161-0 #NEW STOCK
Attachment: New Order2030404.rar (contains "New Order#2030404.exe")

GuLoader payload URL:
http://ratamodu.ga/~zadmin/iclient/sean_SgXXorh87.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 08:36:35 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w5c4s2xctglmw3bjk2hq5uctezgsiuc4fgzj35i5crpm4nadcdwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar b745c96ae29996cb6c29568f0ed053264d24505c29b29df51d145ece340310ec

(this sample)

GuLoader

Executable exe d11cef47f0e97409844b3bc448cfabcfd7f97a4289012ba50e4b7175f5f4c870

  
URLhaus
https://urlhaus.abuse.ch/url/365502/
  
Dropping
MD5 3e9a8404e24ef0479c758fdf71a618a3
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d11cef47f0e97409844b3bc448cfabcfd7f97a4289012ba50e4b7175f5f4c870

Comments