MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecdd7b38b6d6c5cd04d31604d7a63deb0ea3e48d01a655483224201490f0b744. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ecdd7b38b6d6c5cd04d31604d7a63deb0ea3e48d01a655483224201490f0b744
SHA3-384 hash: 52ea8f71ca60e390f4bf9cf92bca02f3933900ae83af0fba5d6aa2fc187b157954569b1f74026ae210e1300ced576f46
SHA1 hash: b8583baaeeef2b74ed024cdd64890eb53fe11626
MD5 hash: c304591bc2f654f512f4728cd2e7d1e7
humanhash: bravo-illinois-low-pluto
File name:Purchase Order Updates thyssenkrupp Materials Australia 900-5400006911.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:73'854 bytes
First seen:2020-06-04 06:04:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:IBR6tfi8Hd60NmpZZWR7HLnfRhjv8XgUCzmGfO2UixlsQa:IBR6tf9cemvARXfRhz8X1AmGfO2U3d
TLSH B87302DCA6F49F899E3920C5E62709466904F9CD46FD868770E7F4878B3E8D8CB20902
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mails.cesosenintl.ml
Sending IP: 193.142.59.85
From: Sales Manager <mark.geyr@thyssenkrupp.com>
Reply-To: mark.geyr@thyssenkrupp.com
Subject: Fwd: Purchase Order Updates / thyssenkrupp Materials Australia / 900-5400006911
Attachment: Purchase Order Updates thyssenkrupp Materials Australia 900-5400006911.rar (contains "Purchase Order Updates thyssenkrupp Materials Australia 900-5400006911.exe")

GuLoader payload URL:
https://qif.ac.ke/anyii_DbAFfSTiIS190.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 03:57:05 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5toxwofw23c42bgtcycnpjr55mhkhzenagtfksbseqqbjehqw5ca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar ecdd7b38b6d6c5cd04d31604d7a63deb0ea3e48d01a655483224201490f0b744

(this sample)

GuLoader

Executable exe dfc7dc8fbb5ca4e70bd22acc87b2c43c507e7967341974504a255554963fac1f

  
URLhaus
https://urlhaus.abuse.ch/url/365506/
  
Dropping
MD5 fddce2578f2c238ed01f97ac3ea972f3
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dfc7dc8fbb5ca4e70bd22acc87b2c43c507e7967341974504a255554963fac1f

Comments