MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb4e2b2570727c29ab727b3a34f637b38b455016d42e14382d05d83671bb555a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb4e2b2570727c29ab727b3a34f637b38b455016d42e14382d05d83671bb555a
SHA3-384 hash: 707ef0150d974d9fd56377ca2c987eb1ab9303f26910588faa546713e6b816bbdf4cca1a0df761ebaeba73daaf355812
SHA1 hash: 493d9d436a249cdb5862309cc8fa00e4337c8520
MD5 hash: e88617cb6fe60345a886a441970f9bb7
humanhash: tennis-thirteen-hot-alaska
File name:Almandineberegnings.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:59'740 bytes
First seen:2020-05-28 07:30:27 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:feTEQ5kgY6asEIPnEBva4ROBSE6F1fRxK5e/pm:fehYT3IPnEBStZIm
TLSH 5A4302FCEBD31294E117A224330EE9DFC63A0AD18DE94D40B146106C72A75CE5B68DF9
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: singnet.com.sg
Sending IP: 172.93.184.203
From: davidkp@singnet.com.sg
Subject: Order # 395
Attachment: Almandineberegnings.zip (contains "Almandineberegnings.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=46B98FE6F0D79519&resid=46B98FE6F0D79519%211842&authkey=ANcfRm-0LjxFJQY

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Injector.EMDX.20161.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 07:38:03 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip cb4e2b2570727c29ab727b3a34f637b38b455016d42e14382d05d83671bb555a

(this sample)

GuLoader

Executable exe a58514d885d493ebb627f107f0a3ded181311e153038fdc1626323bbea512f47

  
URLhaus
https://urlhaus.abuse.ch/url/365781/
  
Dropping
MD5 cafee7ef9054abf3f0597d738feec613
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a58514d885d493ebb627f107f0a3ded181311e153038fdc1626323bbea512f47

Comments