MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da917e975966ed8a851aaeaf2c959c42e4e7dc2dbd123ac992c0c8ba5b05abb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da917e975966ed8a851aaeaf2c959c42e4e7dc2dbd123ac992c0c8ba5b05abb7
SHA3-384 hash: cdcca518a84e313b7be818f783b599a6e02469a09a7b8ff9abfbf0b7014912e9b63d92522bb829f04e85eeb329b03b91
SHA1 hash: e9cc71a208b8f021080ee68aa118d4ee3ea38e66
MD5 hash: 4509886b2a384f73e787a4086f66377c
humanhash: wyoming-wolfram-pennsylvania-illinois
File name:Order CE68384..iso
Download: download sample
Signature GuLoader
Create hunting rule
File size:163'840 bytes
First seen:2020-05-21 15:25:12 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 1536:rWAodV4m8uubLn+PGBR2D29WEYM/iDeAyayGAQgE:DIV4mRubLnHiy9L4b
TLSH F7F3182BFE94AC21D5404DF11DA65BA814AFBC702A714E0B75CFBB1C5773E83A52234A
Reporter abuse_ch
Tags:GuLoader iso


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: symantec3.comsats.net.pk
Sending IP: 210.56.11.8
From: Jackie Kwok <accountant.faisalabad@globalpharmaceuticalspk.com>
Reply-To: dawnimpax2012@gmail.com
Subject: CAMEWOULD - Business Proposal/Quotation Required for Order.
Attachment: Order CE68384..iso (contains "Order CE68384.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=E61E5F3F655316FA&resid=E61E5F3F655316FA%21200&authkey=AO9ztXK9x4tRttY

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader33.44128.29436.12558.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 12:36:34 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso da917e975966ed8a851aaeaf2c959c42e4e7dc2dbd123ac992c0c8ba5b05abb7

(this sample)

GuLoader

Executable exe ef5f67e08e4f10648a4002c0cb4a45a7480498d2d2f3ca02ab6c8561992c803b

  
URLhaus
https://urlhaus.abuse.ch/url/366149/
  
Dropping
MD5 8a2ab9098e351da4d28ac71b4e2c081d
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ef5f67e08e4f10648a4002c0cb4a45a7480498d2d2f3ca02ab6c8561992c803b

Comments