MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff3db1bf078a4d4167b9609516dee0fa997af33ab4bf97a4b77e03069c5c43fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff3db1bf078a4d4167b9609516dee0fa997af33ab4bf97a4b77e03069c5c43fb
SHA3-384 hash: 1032babba47e45028641cf83aae00ca51abd67456feb779448e7446c693b8b490465d015e0f321cee2607f77ba5e34d2
SHA1 hash: 07b4126a19409a685a92f6a80bd1cc6a8b7a25a3
MD5 hash: 333b5254ad9f29eea10be4d33b257818
humanhash: fourteen-wolfram-batman-purple
File name:viospiral ORDER.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-04 21:22:21 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:ZNLSv2rw7MVlPfVIYu/59NmanvRmJubPQ0R5PL4Zt:ZgsBVltIYu/59NmgRmJubxR5zc
TLSH 5B45A405AEB4EC32E14476B4CFA6F29FC761AC311A318907794C379E1F36A469E7025E
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail.teilam.gr
Sending IP: 195.130.78.204
From: Jenny Vougiouklaki <v.jenny@viospiral.gr>
Subject: new Greece order
Attachment: viospiral ORDER.img (contains "viospiral ORDER.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48330.23956.21967.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 20:06:59 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7463dpyhrjgucz5zmckrnxxa7kmxv4z2ws7zpjfxpybqnhc4ip5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img ff3db1bf078a4d4167b9609516dee0fa997af33ab4bf97a4b77e03069c5c43fb

(this sample)

GuLoader

Executable exe 7030c2032fc9a3b15dc8720636f25403873ca65156611b7ccaa2928d716874b3

  
Dropping
MD5 abcccb20b527fcbcc1f27c3380b4e6d5
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7030c2032fc9a3b15dc8720636f25403873ca65156611b7ccaa2928d716874b3

Comments