MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 056ca147d654020441f33ced8510bdbb5a686b0a1769cb1c77ec0a858fa36026. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 056ca147d654020441f33ced8510bdbb5a686b0a1769cb1c77ec0a858fa36026
SHA3-384 hash: dffd8241bc3cbfa20de2b197cbd6fc044f5da246d440dc62e4c80c95c16e66678f5af066d376825a68b8415bcf5d7ffe
SHA1 hash: f38cbaf63380da2371a03d88cd880feb2d3b61d5
MD5 hash: 581c36ccc733cfceef3ae25586350344
humanhash: asparagus-virginia-wyoming-low
File name:0312 RFQ 090701 - DRA-062020-BR.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:44'523 bytes
First seen:2020-06-08 07:12:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:mtxngAGupUMKiKXf5Im8N9DosKfUUBUlMJulL4/Chht7mJ0:ExJGupUFXf5nnfBIM0lLNt7mJ0
TLSH A313F22A29123E28BEC79BDEF72F22D1B8D35407536B90B19AADC19C47D69C62C42543
Reporter abuse_ch
Tags:GuLoader Loki rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: sv49d146.emailserver.vn
Sending IP: 103.15.49.146
From: Le Thi Phuong - KETOAN - XLT [phuongle@xltech.com.vn] <chinhpq@intech-group.vn>
Subject: Re: QPPE-PCC1 09062020 Đơn hàng XL Technical VN – 03
Attachment: 0312 RFQ 090701 - DRA-062020-BR.rar (contains "0312 RFQ #090701 - DRA-062020-BR.exe")

GuLoader payload URL:
http://ratamodu.ga/~zadmin/group/harl_cyMbNbo109.bin

Loki C2:
http://egamcorps.ga/~zadmin/lmark/harley/mode.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 07:14:04 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=avwkcr6wkqbaiqpthtwykef5xnngq2ykc5u4whdx5qfild5dmata._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 056ca147d654020441f33ced8510bdbb5a686b0a1769cb1c77ec0a858fa36026

(this sample)

GuLoader

Executable exe eb4582cb00844df09a71aa8f41a8f05f6775230e35f8775c7b52302dc6d0716c

  
URLhaus
https://urlhaus.abuse.ch/url/374155/
  
Dropping
MD5 cc8496b710d9a8e7cc6b600b25b7fea7
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eb4582cb00844df09a71aa8f41a8f05f6775230e35f8775c7b52302dc6d0716c

Comments