MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 daa0c7e4ba1e3ccc45d9bf819e58aacbf83aa2df18b9544244255a60557199da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: daa0c7e4ba1e3ccc45d9bf819e58aacbf83aa2df18b9544244255a60557199da
SHA3-384 hash: 5ea4c52e11c99a23844bc2e8d24a9ec90a70e065313ef388ccfc6fef711016d84aacf3f9fc820c0da1973f6284cea409
SHA1 hash: c7472731f944925c4af003c8d0903399f505437c
MD5 hash: 41edd30a0398f673f5719a20b869f968
humanhash: august-angel-arizona-eighteen
File name:file.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:44'161 bytes
First seen:2020-06-05 13:41:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:0DwE/f2nzAfSHoPCV84MgzrGIc7blXwCP/2TEY3poTz8Yr92yVvEv+vg5UXkX:0DwE/fTdC+4yIywCnaEQU8YrReAFa
TLSH 0D1302CF41894594951822FFEBD147E911494EB84ABE8709C92E17D4B0E0FF46A3BC85
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: slot0.coinfxpumps.com
Sending IP: 45.95.169.160
From: Nicole Gapes<info@coinfxpumps.com>
Reply-To: gapes.nicole@yahoo.com
Subject: Property Purchase & Leasing
Attachment: file.zip (contains "file.exe")

GuLoader payload URL:
https://rainbowisp.info/dot/js/piro.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22523.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 13:43:03 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3kqmpzf2dy6myrozx6az4wfkzp4dviw7dc4viqseevngavlrthna._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip daa0c7e4ba1e3ccc45d9bf819e58aacbf83aa2df18b9544244255a60557199da

(this sample)

GuLoader

Executable exe 1f6b6d481b672f8ed428a044ebffa9e16424317c0081aad3c00cb61a547b90b5

  
URLhaus
https://urlhaus.abuse.ch/url/379344/
  
Dropping
MD5 62d72973ba17c15eb603ffff5e1315f4
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1f6b6d481b672f8ed428a044ebffa9e16424317c0081aad3c00cb61a547b90b5

Comments