MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04d08bbef9646b62d411d6d7add0b5c2ec13497d7e5a537325b6c3a31c985087. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04d08bbef9646b62d411d6d7add0b5c2ec13497d7e5a537325b6c3a31c985087
SHA3-384 hash: 06cf89d5510471288b5fa567fa406b65abb1f248c5ca762d34bbba596beef55e8d91efef90ca6409cc091ea27b604249
SHA1 hash: c33b34762cd63239b60ddc6f927db938937aa576
MD5 hash: 53d012d8af35ac0d0382d9a7fd9ab32c
humanhash: lake-solar-south-nuts
File name:PO-A2174679-06.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2021-02-23 07:23:26 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:8yafMF8sN5NZilPSBWNBEotYaYUtl8DLogSR:rHF95ilSUNBLtYaYUt7
TLSH 0645F612FE57E118E1A5C5B2D920A9FA10593C72C1018E43B5CE7F2A3B736CA85B1F4B
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: highpro1.com
Sending IP: 167.114.95.64
From: TEJ ADHIKARI <info@highpro1.com>
Subject: Re: Status of Purchase Order // A2174679-06
Attachment: PO-A2174679-06.IMG (contains "PO-A2174679-06.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs2576.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/04d08bbef9646b62d411d6d7add0b5c2ec13497d7e5a537325b6c3a31c985087/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=atiixpxzmrvwfvar23l23ufvylwbgsl5pznfg4zfw3b2gheykcdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/04d08bbef9646b62d411d6d7add0b5c2ec13497d7e5a537325b6c3a31c985087

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 04d08bbef9646b62d411d6d7add0b5c2ec13497d7e5a537325b6c3a31c985087

(this sample)

GuLoader

Executable exe eb53256b217e27a7ab0f71be2181599a79dc0569dea7fdbc5b32cf96a6bc9109

  
Dropping
MD5 fdec289fb4626dd56bbb55770ae5f432
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eb53256b217e27a7ab0f71be2181599a79dc0569dea7fdbc5b32cf96a6bc9109

Comments