MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9f2013f37dae13d7689aeac14cbf58bba50b968a9e8ce3ce19b19f26565aa95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9f2013f37dae13d7689aeac14cbf58bba50b968a9e8ce3ce19b19f26565aa95
SHA3-384 hash: 7ec22fb97e0136bcf43f557d88a75effe8d37db3a2b2a52750fa2f97b0d536973ec87e43b1af6958e36ed1fe0bd43b96
SHA1 hash: bb7f50a21d96cef920e6f10ec698e4de83e12ac7
MD5 hash: 9838b68e95d8c2b3c8808f32135e0825
humanhash: alpha-helium-mexico-pennsylvania
File name:P.O 395756-0.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:52'802 bytes
First seen:2020-05-28 07:30:07 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:U3TdZLirTmjr+m1IgFycOD2ob/tQbQgTkX6RhpddFe:8ZLiS/ggFyPebdU6HpdG
TLSH 46330262A4370E5F39FFBCAB375B68136CA44D1DE5AB01EA8C5491B55321E9CCC3B508
Reporter abuse_ch
Tags:GuLoader Outlook rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: NAM02-CY1-obe.outbound.protection.outlook.com
Sending IP: 40.92.4.100
From: Siham Hello <sihamhello@hotmail.com>
Subject: FWD: Re: Purchase Order 395 #NEW STOCKS
Attachment: P.O 395756-0.rar (contains "P.O #395756-0.exe")

GuLoader payload URL:
http://ratamodu.ga/~zadmin/iclient/sean_SgXXorh87.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 07:38:12 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar f9f2013f37dae13d7689aeac14cbf58bba50b968a9e8ce3ce19b19f26565aa95

(this sample)

GuLoader

Executable exe e1ef53521aed004fe790b232883a12cb5f241ead4c81718b08ac0150323563d4

  
URLhaus
https://urlhaus.abuse.ch/url/365502/
  
Dropping
MD5 e6c6591cc1b529cf28eadad116795198
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e1ef53521aed004fe790b232883a12cb5f241ead4c81718b08ac0150323563d4

Comments