MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d45cb0cc3ad0cf6ffe10da946aa402b9e227fb0ac2a989e37904c8626c34c2c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d45cb0cc3ad0cf6ffe10da946aa402b9e227fb0ac2a989e37904c8626c34c2c0
SHA3-384 hash: a84ef12fa59d425d08b9e5020b93d7c03a03e139c4150cc2bc5d8fb70879ba6b832b08ac9c45fbfa109088c45a10d4a3
SHA1 hash: 2071d7ef2367afc7b4d56ba805016d8be9246e53
MD5 hash: 35029684e39cf6975e9f1345ea9f6b7f
humanhash: sad-stream-double-mississippi
File name:SWIFT TRANSFER COPY.pdf.r07
Download: download sample
Signature GuLoader
Create hunting rule
File size:24'172 bytes
First seen:2020-05-22 15:04:44 UTC
Last seen:Never
File type: r07
MIME type:application/x-rar
ssdeep 384:HR7qiUg1j/haUeON485wPOQvWHbl3Bi/RaXq+kbjSzlVqZzgJifPLQ3JW1:HROiUUrhjeON48imQ+p3BYRaDkHGlwqK
TLSH 7BB2D1DE38B4780F24593F8A4807AF33CEAD2CA95175B9FBD52ADE9614200B18D43D6D
Reporter abuse_ch
Tags:GuLoader r07


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: pro03.emailserver.vn
Sending IP: 103.15.48.223
From: ACCOUNTING <kt_1@achison.com>
Subject: RE: Payment Receipt
Attachment: SWIFT TRANSFER COPY.pdf.r07 (contains "SWIFT TRANSFER COPY.pdf.bat")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1zpSdW4Tji4URCA69dGKz-v62r_7LJazk

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 15:35:59 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
14 of 30 (46.67%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

r07 d45cb0cc3ad0cf6ffe10da946aa402b9e227fb0ac2a989e37904c8626c34c2c0

(this sample)

GuLoader

Executable exe 6523cec93d68e38809ee7a9da3121fd5e535d2755828f668aa507a0b0d18b1e4

  
URLhaus
https://urlhaus.abuse.ch/url/366785/
  
Dropping
MD5 76390b2700d20925f6372f1302eca538
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6523cec93d68e38809ee7a9da3121fd5e535d2755828f668aa507a0b0d18b1e4

Comments