MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0600689fca8d650af28d4bc76a3b45e347cc8b020ee286057f69c1048d4839d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0600689fca8d650af28d4bc76a3b45e347cc8b020ee286057f69c1048d4839d6
SHA3-384 hash: 51663bdcd85c69de958a3f7dae9f4fcfb65c783770a2fb2cc5c561b961e009a6de6510149f331a54f3f9ad6e3985a0aa
SHA1 hash: 34c65ac8b234e17bb505595cc63546d80cbe7a43
MD5 hash: a6f87ed8464d8166305cdc0b82d28ea0
humanhash: tango-alpha-july-wolfram
File name:DHL_AWB - 4626263633_pdf.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:75'401 bytes
First seen:2020-06-04 06:02:39 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 1536:YscSC6PIJwOO1SX0DJdsZ8tckju4NW4aL4Ksmc7P7I09X:Y976wWOY2Gr1PQ3Q77X
TLSH 207302B3EC66EDE42E0BADD0FE44650F327DE5C1229233899D0A6C16C4F429629FDB51
Reporter abuse_ch
Tags:DHL GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mails.abidjiaintl.ml
Sending IP: 193.142.59.76
From: DHL EXPRESS© <customersupport@dhl.com>
Subject: DHL Notification AWB - 4626263633
Attachment: DHL_AWB - 4626263633_pdf.gz (contains "DHL_AWB - 4626263633_pdf.exe")

GuLoader payload URL:
https://cmdtech.com.vn/build__ol_OrFUVF212.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 03:57:05 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ayagrh6krvsqv4unjpdwuo2f4nd4zcycb3rimbl7nhaqjdkihhla._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 0600689fca8d650af28d4bc76a3b45e347cc8b020ee286057f69c1048d4839d6

(this sample)

GuLoader

Executable exe 8b791216101006bea031bc4ff657001f95cd58ed1db4429a242d79050f947d40

  
URLhaus
https://urlhaus.abuse.ch/url/376004/
  
Dropping
MD5 10b77896ae596abe27f1979d29bd4a6e
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8b791216101006bea031bc4ff657001f95cd58ed1db4429a242d79050f947d40

Comments