MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6477d3fb83f09d92d95e78550f55f28685e4b7799d2b9b64eec0db79fe536aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6477d3fb83f09d92d95e78550f55f28685e4b7799d2b9b64eec0db79fe536aa
SHA3-384 hash: 00730a50bb89db480dde1dabc899d5d835bdd857f0707276f1e934e0df78302766c0afd9b42a4afcaaea700467f71964
SHA1 hash: 4749f47c00297f4dd2ddeda0af862f6a52b43222
MD5 hash: ed57af93099c8b46c6f168ec30d36d2d
humanhash: mountain-arizona-foxtrot-zebra
File name:Quote_98045300_76873342.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:30'165 bytes
First seen:2020-05-26 07:37:58 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:WKb4Gzy+8YoZCR4RZLVOkdH5IVTuEfmIggOTFy3H8HjcFaDtt+:WIz4VCRONHI8EfmIrOTFEH8waDW
TLSH 5BD2F1B1ABB732A0810B150F8127182AB977067A2825BFC25FD253F791A57E3377B201
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: outlook.com
Sending IP: 103.89.88.225
From: Nguyen Thi Kim <seyekozoko@outlook.com>
Reply-To: goodluckfresh@gmail.com
Subject: RE: Quote_98045300_76873342
Attachment: Quote_98045300_76873342.zip (contains "Quote_98045300_76873342.exe")

GuLoader payload URL:
http://hosseinsoltani.ir/wp-includes/build_IedqfEnQId16.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 08:49:07 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip c6477d3fb83f09d92d95e78550f55f28685e4b7799d2b9b64eec0db79fe536aa

(this sample)

GuLoader

Executable exe 3aa51ec61736aeeb1f90d430d696ee1c27ab773afec909da129fd171ba895f3e

  
Dropping
MD5 e87ae69bf935653aa7a6f37b443af7bc
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3aa51ec61736aeeb1f90d430d696ee1c27ab773afec909da129fd171ba895f3e

Comments