MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bed85b6c7b530f3561f37792a5fdc52fad0d68d499992b883c433c86c2bfd84d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bed85b6c7b530f3561f37792a5fdc52fad0d68d499992b883c433c86c2bfd84d
SHA3-384 hash: 6cf992c09b950acaafb0c590b99b2b5374d6f884b8f630ac110c693c900d871990ffe9841fb0509c7d4e866ac08a9cef
SHA1 hash: 456ec1319d539c125002d97c923414a0e487dd6e
MD5 hash: c702e2a337bc08a4a2c3b2ac85e9972d
humanhash: fifteen-sierra-salami-crazy
File name:Bank details_pdf.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:75'085 bytes
First seen:2020-06-03 13:17:20 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:edMUriEc0KJI3iP/5Fv1CW0DIUu9wYoIhxAHgxe8nQfgF4QXHhisQjJfT:PUmEcE3iZNwJ0RToDqergF4QksQ5
TLSH 5F7302024274DE03175A2B6C23D6A14B4973DD5A50ABC75ECB760ED151CA82CC3EA7DE
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server1.arsari.co.id
Sending IP: 43.252.137.130
From: Atlas Industrial and Consumer Trading CC <accounts@aictcc.co.za>
Subject: REMITTANCE ADVICE: IF01200022823419 For Confirmation
Attachment: Bank details_pdf.rar (contains "Bank details_pdf.exe")

GuLoader payload URL:
https://qif.ac.ke/kayP_zzZBumFpCL90.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 13:37:55 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x3mfw3d3kmhtkypto6jkl7off6wq22gutgmsxcb4im6inqv73bgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar bed85b6c7b530f3561f37792a5fdc52fad0d68d499992b883c433c86c2bfd84d

(this sample)

GuLoader

Executable exe 991289640d200976fd319f76f9acbbf7f3e304b24b5117cb8da23bcf091b2a06

  
URLhaus
https://urlhaus.abuse.ch/url/365990/
  
Dropping
MD5 f00daabd36fbc4313a46d2cad874ac4c
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 991289640d200976fd319f76f9acbbf7f3e304b24b5117cb8da23bcf091b2a06

Comments