MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7904b50a13c4662872a03ae27e21ce01696e74cd4d66f904154285cd55e657e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b7904b50a13c4662872a03ae27e21ce01696e74cd4d66f904154285cd55e657e
SHA3-384 hash: a80c1fa3b3112fd637b207af7d627bed34c870fab6cc6ff03a83215e4b761334fab3b85914f277474b313ab5fdaf8257
SHA1 hash: 4243926969b208e8393191a90ad91807e3ae1275
MD5 hash: c99f1e263bd7ea3db3def5a6310aca8f
humanhash: maryland-echo-summer-washington
File name:TT_PDF.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:34'275 bytes
First seen:2020-05-26 11:20:54 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 768:3YW9XQP/N2/Jih/XWu1+UsHlkP8/G0bq/KhfMu2Uhvmhv96r0OHtm:3YW9XQP/N2/JiZGuKF+0bqSleYOhvYS
TLSH C9F2E15BBF1EAA2C40870BC56020F56DB91498CFF608094CE9738DF76273D5763AA50A
Reporter abuse_ch
Tags:geo GuLoader gz KOR


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: dnn.co.id
Sending IP: 202.47.91.18
From: Shinhan Banking Financial <sveed@dnn.co.id>
Subject: 결제 전표 – 결제 완료 22/05/2020 (마지막 알림 !!!)
Attachment: TT_PDF.gz (contains "TT_PDF.exe")

GuLoader payload URL:
https://kinansreview.com/MY_XXX_VUVHawg214.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Occamy
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 11:37:10 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz b7904b50a13c4662872a03ae27e21ce01696e74cd4d66f904154285cd55e657e

(this sample)

GuLoader

Executable exe 9bc42c118c6cc7a45c18fc844e0e132c28cfe4f90380f8a6e1305a798b3d15fb

  
URLhaus
https://urlhaus.abuse.ch/url/368804/
  
Dropping
MD5 23aa5a45a804d0ec14766800f8cbb3e6
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9bc42c118c6cc7a45c18fc844e0e132c28cfe4f90380f8a6e1305a798b3d15fb

Comments