MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f76df6fbfe763902b61f6be764ec1b250d6e5351e63b0f155eec41e7e61cdae9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f76df6fbfe763902b61f6be764ec1b250d6e5351e63b0f155eec41e7e61cdae9
SHA3-384 hash: 4e86136ab1f4d6f195140d25bb56f38a5973cf9e696bfb7408ac5a1fc8c577d24537b9384efd83149c1f5b4db61fa9e6
SHA1 hash: 232805dcfad24cf8d6adfac92375a5be5f8cb1b0
MD5 hash: ab3ff75bee3a74530d71f6e4a8719051
humanhash: ceiling-moon-oranges-texas
File name:Purchase Order.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-02 11:16:36 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:aM4FO8lL5kiEsTrBPnD8WLzwKQwpkb/mNetO:a8EpD8IzwPAT
TLSH 884508477BD45601F1B24A712FBB825AAF25FC294C429A0F350D3A4B3B31762996C72F
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: teyseer-services.com
Sending IP: 104.168.141.201
From: Khadirulla Shariff <khadirulla.shariff@teyseer-services.com>
Reply-To: Khadirulla Shariff <khadirulla.shariff@teyseer-services.com>
Subject: Purchase Order
Attachment: Purchase Order.img (contains "Purchase Order.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1LZ3T_Qk2zQPT_y0mEy8QFrfZnJBNKMYM

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 11:37:51 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=65w7n676oy4qfnq7nptwj3a3eugw4u2r4y5q6fk65ra6pzq43luq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img f76df6fbfe763902b61f6be764ec1b250d6e5351e63b0f155eec41e7e61cdae9

(this sample)

GuLoader

Executable exe c8ea056cb229cc17d43217a6aba42320468cfaea55d6f9846b5f402bab6b06d0

  
URLhaus
https://urlhaus.abuse.ch/url/374163/
  
Dropping
MD5 10406f69817d304806553237e812cf59
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c8ea056cb229cc17d43217a6aba42320468cfaea55d6f9846b5f402bab6b06d0

Comments