MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6d6127fcf10980672d0ac98b25b7ddb3fe0e647c638d58d54e1871c18206b7d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6d6127fcf10980672d0ac98b25b7ddb3fe0e647c638d58d54e1871c18206b7d
SHA3-384 hash: 41ba69830e94142bee63da85f92a66474db8e6d0bf56051f2a57a9088cf7e8b18380667c14a7abd84bca11780e268dee
SHA1 hash: a9f8c5b99cc522bc0cf221bdd3b6ad83027f98e6
MD5 hash: 7935890925341d15b9cda982f2441377
humanhash: eighteen-tango-table-ack
File name:E200511005R01_Sun Shine PJTEmerson SG_18May2020.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-27 17:16:53 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:tpTrWruJzl5BDQMixFkyRgx/+qcWlOHAYxOqWOFoXu0yCydrTBsqhkvu9Su5JhlN:3rWmzli/kyCxCWEgYxOFXXyNshu9zN
TLSH 1145E70376E19CB2EC359FF11A7196645D33BD282A110B07750CFB8E2F336DA6A50B5A
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server.ecomotorhk.com
Sending IP: 162.144.56.225
From: Batgerel Odsuren <odsuren.batgerel.me2@eng.nssmc.com>
Reply-To: odsuren.batgerel.me2@eng.nssmc.com
Subject: Request for Quotation of Screw Decanter Centrifuge_CE1 Project/AA167194000000 (Muhan Technical)
Attachment: E200511005R01_Sun Shine PJTEmerson SG_18May2020.img (contains "order.exe")

GuLoader payload URL:
http://185.94.191.88/bin_qNQJqzF250.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Jaik.40167.28238.25164.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 17:37:06 UTC
AV detection:
15 of 30 (50.00%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img c6d6127fcf10980672d0ac98b25b7ddb3fe0e647c638d58d54e1871c18206b7d

(this sample)

GuLoader

Executable exe 6da928194ba7abbc975b4b7ce1415b1fc7787a459f137ce07498920fd740bf68

  
URLhaus
https://urlhaus.abuse.ch/url/368753/
  
Dropping
MD5 78742e932f516bf6fb2e9dd7f1c33d8a
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6da928194ba7abbc975b4b7ce1415b1fc7787a459f137ce07498920fd740bf68

Comments