MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2769aa2054cdad5c476b718e569c6445d9013e82a86b73c339c928cbef9d905. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2769aa2054cdad5c476b718e569c6445d9013e82a86b73c339c928cbef9d905
SHA3-384 hash: 580672cc98ecb311866b6ab6b42ccd0a307a78afd2996ef9469e064da6e50b1ed174bf7d590a3d6163a756297d8f37ae
SHA1 hash: 175f092201f70ba5cc6a05d60ebe07247e5a5515
MD5 hash: c8b0f5372d0cc36795694a46588bc48a
humanhash: skylark-beer-bakerloo-colorado
File name:Rechnung..zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:30'637 bytes
First seen:2020-05-23 15:16:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:fbMVlPGeKW0les+3a8buWWTlgcGie1e16kPiV0z:g/ueF04siUDlgcGiB16/V0z
TLSH 74D2F125EEE13A9364121D39D20D790F09B49BCCF8749BDCC7983EB00578D6D260BAA7
Reporter abuse_ch
Tags:DEU geo GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: dd37126.kasserver.com
Sending IP: 85.13.153.207
From: info@schloss-willebadessen.de
Subject: AW: AW: Zahlungsbeleg und Auftragsbestätigung 23-05-20 Rechnung_20-613129926-001
Attachment: Rechnung..zip (contains "rechnung1.exe")

GuLoader payload URL.
http://156.96.118.179/RSol.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23811.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-23 15:35:38 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip c2769aa2054cdad5c476b718e569c6445d9013e82a86b73c339c928cbef9d905

(this sample)

GuLoader

Executable exe 6ee45fdfe890e0199f1c72f05fd27218c358ddce153f85d4e683d3ba72dbc2d8

  
URLhaus
https://urlhaus.abuse.ch/url/366085/
  
Dropping
MD5 08146f38e5e4c5e24cd966ffb86db7b5
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6ee45fdfe890e0199f1c72f05fd27218c358ddce153f85d4e683d3ba72dbc2d8

Comments