MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5639a7177417ed371ab1120238dec55f5f3e50bf2f33163356ff6de18ca4ac0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5639a7177417ed371ab1120238dec55f5f3e50bf2f33163356ff6de18ca4ac0
SHA3-384 hash: ecdd8a2151cdff69a343631e7174806d76db54d2e733d906850381b21245986fab0f4faf9eac26fd538fde00e4b3c583
SHA1 hash: d7120296c981446a4f4de68beac1d531291a3248
MD5 hash: 7fe43fd5fb7385e246626bfc147cf672
humanhash: winner-yankee-robin-colorado
File name:ANSI-WCBD.ICF8-3-Layout2.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-27 17:13:56 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:krzGp55g6t9D7UOxYE06HdOIxTevPofOg:yzGf5gOFfP02cTa
TLSH 4445071772806C71ED24CFF1587DA6A06D26AC327C022A0B750DF71E377A5CAE6E174A
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server.ecomotorhk.com
Sending IP: 162.144.56.225
From: Batgerel Odsuren <odsuren.batgerel.me2@eng.nssmc.com>
Reply-To: odsuren.batgerel.me2@eng.nssmc.com
Subject: Request for Quotation of Screw Decanter Centrifuge_CE1 Project/AA167194000000 (Muhan Technical)
Attachment: ANSI-WCBD.ICF8-3-Layout2.img (contains "order.exe")

GuLoader payload URL:
http://185.94.191.88/bin_qNQJqzF250.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.879400.19650.30706.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 12:56:44 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img e5639a7177417ed371ab1120238dec55f5f3e50bf2f33163356ff6de18ca4ac0

(this sample)

GuLoader

Executable exe 7182bcf31d8093823a0625f050886ed0cc295b488618e28a8c5417462004a7e8

  
URLhaus
https://urlhaus.abuse.ch/url/368753/
  
Dropping
MD5 761d83e237f8fe53849e88342ff7f5ca
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7182bcf31d8093823a0625f050886ed0cc295b488618e28a8c5417462004a7e8

Comments