MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 043448018365468a9ab42641afe6e91fb508e0fe5448ec8b5b4c9aeb453ed93b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 043448018365468a9ab42641afe6e91fb508e0fe5448ec8b5b4c9aeb453ed93b
SHA3-384 hash: f98a01ede317afe93631ce1cb12dc787b9ec1e6467a5bace08fbb06419b588f5dfc784df7cb8f27dca0c09f534acb6dd
SHA1 hash: ceff7b1d04f10ec83ebf1e2f053da352252ea32d
MD5 hash: 80a06cbbc99f48665b63ba66625bb59a
humanhash: georgia-winner-table-zulu
File name:cotización.pdf.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:45'233 bytes
First seen:2020-06-05 19:34:44 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 768:u03jFVl6XOfbHE6Sq/wUm1Q3yx9z7Tpjf4IFteCg2VFfw5mL8sOF:/6XOfbHbr/I0o9HTt4IFEKw5mIP
TLSH B21302C0EB147F823AD1EC69AD40E95D2C879B6C311B55D2B39DDE9638AC4AF6100F94
Reporter abuse_ch
Tags:GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: aa98419.online-server.cloud
Sending IP: 74.208.129.40
From: Cynthia <CynthiaEstefania.Rodriguez@hlag.com>
Subject: Re: Muy urgente Nueva consulta / orden de cotización
Attachment: cotización.pdf.gz (contains "cotización.pdf.bat")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1MVkhOuUYWh6VYQ2ZdLkKXoriBbyDnDgj

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 19:35:58 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aq2eqamdmvdivgvueza27zxjd62qryh6kreozc23jsnowrj63e5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 043448018365468a9ab42641afe6e91fb508e0fe5448ec8b5b4c9aeb453ed93b

(this sample)

GuLoader

Executable exe f8dec47c69d225551ae101236be38ea50944b01e14f64a8e5d4758c8e20ec6bb

  
URLhaus
https://urlhaus.abuse.ch/url/382342/
  
Dropping
MD5 5d45b0c888cdf6e01cab016f3380654d
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f8dec47c69d225551ae101236be38ea50944b01e14f64a8e5d4758c8e20ec6bb

Comments