MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1bcbaf8c9ec8d20d337ff5ead1771eaa5e315d295d8bc63ade1726c16c6535b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d1bcbaf8c9ec8d20d337ff5ead1771eaa5e315d295d8bc63ade1726c16c6535b
SHA3-384 hash: a2b069fc0566d12af66a470fe762726db5ec865ca104cc74a893bbd3a110659f66998e896bdcac19c513e8df6be4fa12
SHA1 hash: cd49a29b3e28d684fc1a785ad4293eb9099cfa22
MD5 hash: 88fc0a0285fba07609a7f58a8adeba7c
humanhash: oregon-indigo-beer-mike
File name:Inquiry Doc 505_20.001
Download: download sample
Signature GuLoader
Create hunting rule
File size:74'307 bytes
First seen:2020-06-03 17:25:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:JXXTOdY9+Am0jwka+4VcULC9v9zy9wFu2qY2HY/EmIM5REXinrxnPW+V:RXym9PvXa+wA9y9QqxHYMH4RPW+V
TLSH 2173028049AA50043F355A30BC7B7477A81CF6AAC256FEFC797D5A600FAE6168C0C61F
Reporter abuse_ch
Tags:001 GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

From: "EXPORT-MANAGER"<katia.jamieson3@faber-castell.com.pe>
Subject: NEW ORDER_Faber-castell
Attachment: Inquiry Doc 505_20.001 (contains "Fehaareneri.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1lAYLsRpKoJyKEjlzzkV0Z7IMh3R-ifiA

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 17:36:01 UTC
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2g6lv6gj5sgsbuzx75pk2f3r5ks6gfossxmlyy5n4fzgyfwgknnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar d1bcbaf8c9ec8d20d337ff5ead1771eaa5e315d295d8bc63ade1726c16c6535b

(this sample)

GuLoader

Executable exe 29bcd4f06dd92b104f47acf511a47742f03d7eca0321ad099c964954416f821d

  
URLhaus
https://urlhaus.abuse.ch/url/376248/
  
Dropping
MD5 8a5aaed89aaca5d91e6b6c591381eaa5
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 29bcd4f06dd92b104f47acf511a47742f03d7eca0321ad099c964954416f821d

Comments