MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dbbe41c4675a9fdd6b457ae507dd46dfb908b00d0aeddf4156e22a4ecf5b8c82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dbbe41c4675a9fdd6b457ae507dd46dfb908b00d0aeddf4156e22a4ecf5b8c82
SHA3-384 hash: 5f8505a3ae7f5eca2f8052946aac2fdf6bf5088a79d22a49b113dacebef7a94dac58e6238e3f2b991ac8a19a4d415566
SHA1 hash: 953f5f5d696d8e352e8905b97e34abbc3a5d3428
MD5 hash: fb82a0636494a6212bc5bec151de4526
humanhash: november-west-lake-florida
File name:New P.O 1278.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:31'393 bytes
First seen:2020-05-26 09:07:03 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:4vNnaYo/Y949e4dxd4roIR36SHbcBW/SWxeAv9tiyt4U:onbf4Vi8GHcsDiy3
TLSH FBE2E176FA2C94F7C355A5832B7B7045346A4FB36130E9050A0A88E5D6FB1C6C2B43E6
Reporter abuse_ch
Tags:GuLoader Outlook rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: NAM04-SN1-obe.outbound.protection.outlook.com
Sending IP: 40.92.11.44
From: larry herman <lher41@hotmail.com>
Subject: RE: New PO
Attachment: New P.O 1278.rar (contains "New P.O #1278.exe")

GuLoader payload URL:
http://ratamodu.ga/~zadmin/iclient/sean_SgXXorh87.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Graftor
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 09:37:21 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar dbbe41c4675a9fdd6b457ae507dd46dfb908b00d0aeddf4156e22a4ecf5b8c82

(this sample)

GuLoader

Executable exe 25cafcbe57ac5344ade543948fbba1f8a5b99d424af61a7d4e9d806e7c66f79d

  
URLhaus
https://urlhaus.abuse.ch/url/365502/
  
Dropping
MD5 5bf51c025bddd4f88ff2493b7bb3afb0
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 25cafcbe57ac5344ade543948fbba1f8a5b99d424af61a7d4e9d806e7c66f79d

Comments