MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f90abc63b0dcf97d70cc28982e8bc3eb6665087a0251dfe9b2f6ef21fc467735. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f90abc63b0dcf97d70cc28982e8bc3eb6665087a0251dfe9b2f6ef21fc467735
SHA3-384 hash: 698807a96c92adbbfdbe4ee9856fdf9ecc88737e04f2fe3cc11556f0f9e1e187e99fd989d7664b619105af2bac6a6067
SHA1 hash: 115b8e4d7be196fe9e4d22e864b656359b903480
MD5 hash: 3f602a9c16b3829514b7ee4dc8e8e0ec
humanhash: shade-maine-berlin-king
File name:Payment Details.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:35'262 bytes
First seen:2020-06-02 11:10:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:x6C5RQGTPxS1XPpwLh8kHcHq1NZm2F7iOKNnhKjs9NHiJwZ019:8CYCxS1XPpwb8Kxm2FetnhuqpiJwZs9
TLSH FDF2F2B0AC431DB058EBB9D7AC24AE97D96EF337E820E29878A699D5D579D04309010F
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: vps.aquawetsenterprises.com
Sending IP: 45.95.169.142
From: Accounts <info@aquawetsenterprises.com>
Subject: Re: Payment Details
Attachment: Payment Details.rar (contains "Payment Details.scr")

GuLoader payload URL:
http://84.38.133.164/bin_aLxfrX174.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 04:02:36 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7eflyy5q3t4x24gmfcmc5c6d5ntgkcd2aji572ns63xsd7cgo42q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar f90abc63b0dcf97d70cc28982e8bc3eb6665087a0251dfe9b2f6ef21fc467735

(this sample)

GuLoader

Executable exe a7cfc6a8e508a244063a4190921f1c91e30712838282fb20b8bcdb24b138bb9e

  
URLhaus
https://urlhaus.abuse.ch/url/374437/
  
Dropping
MD5 104dd1ca7a54d30be1b255fc1be945ce
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a7cfc6a8e508a244063a4190921f1c91e30712838282fb20b8bcdb24b138bb9e

Comments