MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f52a8031ff6e71f6898fd49e036005f23dabe711a077c4d7fdcba350b7c65301. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f52a8031ff6e71f6898fd49e036005f23dabe711a077c4d7fdcba350b7c65301
SHA3-384 hash: 38cae20f9b9be90fbd691234edfc04f62ae7ee1810d094f60c80851da5fae39df97bff24c04c0c9cdab114e19dba74a3
SHA1 hash: 79e60c516fb291d326296edd515f38c5a139a93c
MD5 hash: 978a9fbc48d49519719d6b301159e0db
humanhash: leopard-table-one-undress
File name:FOQ20-0514-0064_PT. UNGGUL PRAKARSA PRISMA.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-27 17:15:49 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:Tb7ZHucDgll6sMMwHDC142ndoVkGuGvKFdE1h7jZQTm8UmgZUJZLRJrPrAAh:bZHuDXndoVkcKFWz7Gm1Cd
TLSH D745E713B9C05CB2D9B88FF11D629D961E36BD2278014B0B764CBB8D1B361CE65E079B
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server.ecomotorhk.com
Sending IP: 162.144.56.225
From: Batgerel Odsuren <odsuren.batgerel.me2@eng.nssmc.com>
Reply-To: odsuren.batgerel.me2@eng.nssmc.com
Subject: Request for Quotation of Screw Decanter Centrifuge_CE1 Project/AA167194000000 (Muhan Technical)
Attachment: FOQ20-0514-0064_PT. UNGGUL PRAKARSA PRISMA.img (contains "order.exe")

GuLoader payload URL:
http://185.94.191.88/bin_qNQJqzF250.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Jaik.40167.22156.7694.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 12:57:40 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img f52a8031ff6e71f6898fd49e036005f23dabe711a077c4d7fdcba350b7c65301

(this sample)

GuLoader

Executable exe 1743a5e236fbc214c0199172ba07c57b9e171e9865603f9a6b114dfb9ce5c17c

  
URLhaus
https://urlhaus.abuse.ch/url/368753/
  
Dropping
MD5 fb84a96677328c2b3a34905e6203d1d0
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1743a5e236fbc214c0199172ba07c57b9e171e9865603f9a6b114dfb9ce5c17c

Comments