MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec67a927c8d9efc338079a3992515ce8469c6eab8c2bbba3f43d9f504bd474f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec67a927c8d9efc338079a3992515ce8469c6eab8c2bbba3f43d9f504bd474f4
SHA3-384 hash: d6ce6a209593db9ac9b4495bad8198e3392c84941c9b2d8a9ff10c3b0d065b493c2ef1ce84ec25ebd5f5807a9b5b4c08
SHA1 hash: 010fd2d8b3b21b7c96c7adf6fd3274019a851e80
MD5 hash: d26ed19760e997919d2148c15ff8fc51
humanhash: east-venus-nuts-bluebird
File name:20200521.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-21 08:40:50 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:fonbmzDiir6IEe6CA8HgZ4LEsRG1YyhJP7oLPNtrmaBmCi:ybmzDDryevEsRcYynPMhs4mv
TLSH 2A45E620FA64ECA1D93543FD5E728E58113BFC394A21CA4730CE775D2BF6588A9B170A
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm37.hanmail.net
Sending IP: 203.133.180.225
From: 이재호 <bbhbbs@hanmail.net>
Subject: 요청자료목록
Attachment: 20200521.IMG (contains "20200521.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1TEWrW1QSLXn6sGRHrBAnEVVcrODf4rE5

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.47920.4078.23117.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 23:12:59 UTC
AV detection:
16 of 30 (53.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5rt2sj6i3hx4goahti4zeuk45bdjy3vlrqv3xi7uhwpvas6uot2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img ec67a927c8d9efc338079a3992515ce8469c6eab8c2bbba3f43d9f504bd474f4

(this sample)

GuLoader

Executable exe 4f58248f7b2fe19b063a5df2d076b9014ba98090523db6ee9199e04357fe5917

  
URLhaus
https://urlhaus.abuse.ch/url/365527/
  
Dropping
MD5 8ecf4598aff47b280c734add861e30a4
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4f58248f7b2fe19b063a5df2d076b9014ba98090523db6ee9199e04357fe5917

Comments