MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 066c9d8e3aaedcfee2ade864cea5afa353f14d80979b19468e790354460efd67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 066c9d8e3aaedcfee2ade864cea5afa353f14d80979b19468e790354460efd67
SHA3-384 hash: f73bd969d956f3be6aab151855b4f72170ae12665deb7b7a2936649527fc38c24471ce3b38ae8790227998fe16167bc3
SHA1 hash: 217bd98c688e10abb7e04835b7be44646a38bd4a
MD5 hash: 656fbbe3e96b40ccaf77f0696fcadd3d
humanhash: south-one-eighteen-king
File name:PR-0012575 P 999.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:266'647 bytes
First seen:2020-10-12 05:59:56 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:Fev2pfFSKldbMp6SMMQR5qPMfdR8RVvKzyAQ/OVgVgHnOgEAz5X+q:FevuL4qQPMFavKqgKgHOyzwq
TLSH DD44230BC1611716B58F90BC28526455D8AFA3B9F257B5CE0BD820DCF6AD74C8F368E8
Reporter abuse_ch
Tags:GuLoader gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: Sharif qasim <sharif.qasim@redcoalmana.com>
Subject: PRICE & DELIVERY
Attachment: PR-0012575 P 999.gz (contains "PR-0012575 (P 999).exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/066c9d8e3aaedcfee2ade864cea5afa353f14d80979b19468e790354460efd67/
Threat name:
Win32.Trojan.LokibotCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 00:57:33 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=azwj3dr2v3op5yvn5bsm5jnpunj7ctmas6nrsruopebvirqo7vtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/066c9d8e3aaedcfee2ade864cea5afa353f14d80979b19468e790354460efd67

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 066c9d8e3aaedcfee2ade864cea5afa353f14d80979b19468e790354460efd67

(this sample)

GuLoader

Executable exe 835de94d6d37297ee0720dff2f6581168a795e25f95ff841c9cb0f634272e445

  
Dropping
MD5 c250c64dd8239ab5c0c8b316c58d5540
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 835de94d6d37297ee0720dff2f6581168a795e25f95ff841c9cb0f634272e445

Comments