MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f44638e6474a1705c674210b0104afb6af90ba63b567961e2040b980fe0162ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f44638e6474a1705c674210b0104afb6af90ba63b567961e2040b980fe0162ee
SHA3-384 hash: df2ba5d5c988b6b55c9d7f4f4336d988191ad79163d64f31286bd9c8a44b3bba84d5341bf674e3b37186a55851db0ca8
SHA1 hash: bca7132716ef128d7b40a3b814498298d52201a8
MD5 hash: 716e601403e951835c76df86896979e1
humanhash: kitten-mars-romeo-colorado
File name:ENQ NO. 42020.r7z
Download: download sample
Signature GuLoader
Create hunting rule
File size:19'746 bytes
First seen:2020-04-29 04:07:54 UTC
Last seen:2020-04-29 05:45:56 UTC
File type: rar
MIME type:application/x-rar
ssdeep 384:Xr4evIJNJXoYhDXr+lRzVOkGoN2TkzdthH0ecuzuAAZgxJHxb+xCB4BiXMrcSqPi:UQIJjv7+lRzVOwN2wzhH0Fuz7AZgbHxQ
TLSH EB92E15A1CF048B233AA7F971D9DDDAB821B32E109F9D8FB41381DE5249F147225DC68
Reporter cocaman
Tags:GuLoader r7z


Avatar
cocaman
Malicious email
From: "BENEDICTA"<sales@reroygroup.com>
Received: from vpsmx.idetiweb.com.mx (vpsmx.idetiweb.com.mx [162.241.176.18])
Date: 29 Apr 2020 00:33:32 +0200
Subject: ENQ NO. 42020 - RATE AGREEMENT FOR THE SUPPLY AND DELIVERY OF CABLES TO AGA
Attachment: ENQ NO. 42020.r7z

Intelligence

File Origin
# of uploads :
2
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-28 19:23:46 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
22 of 30 (73.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6rddrzshjilqlrtueefqcbfpw2xzbotdwvtzmhraic4yb7qbmlxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar f44638e6474a1705c674210b0104afb6af90ba63b567961e2040b980fe0162ee

(this sample)

GuLoader

Executable exe d03f1c27dca16c26703aaecda761c60320fa3c0c69fc5d32bb20ccecd1d08d1d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d03f1c27dca16c26703aaecda761c60320fa3c0c69fc5d32bb20ccecd1d08d1d

Comments