MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06c4c7adc57647640c146e7246f9408f8f14ff08ae2287014041d605532fe9e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06c4c7adc57647640c146e7246f9408f8f14ff08ae2287014041d605532fe9e9
SHA3-384 hash: c1020253597f1f97572920e3dadf8eb6cad3b9ccd3e3de60ee04bcb58097fe5c7013703f6866ec3c848efce447625d7b
SHA1 hash: d4419677f074afb643a1d77763050a8fe22f794f
MD5 hash: b1b7cec7289ed72e11b693fbaba31587
humanhash: east-lactose-iowa-pennsylvania
File name:PO8592505_pdf.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:34'428 bytes
First seen:2020-05-26 07:53:23 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:jzfbpK/unsA5qmuaYyK7fj5aIQO+mQWK7jqmh6AWuzo4YX:jzfE/usAIbapgfNaI9Qqm9o4K
TLSH 98F2E1A622F2805DC5A29DBFDFDF77EA171391B5AD406DAA50BAF01C04BE68D0CC6344
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: seed.net.tw
Sending IP: 139.175.54.24
From: info@alaskerparkers.co.uk
Subject: New PO.
Attachment: PO8592505_pdf.zip (contains "PO8592505_pdf.exe")

GuLoader payload URL:
https://weareupstream.com/n/bin_KiMXIY135.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Occamy
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 08:36:38 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 06c4c7adc57647640c146e7246f9408f8f14ff08ae2287014041d605532fe9e9

(this sample)

GuLoader

Executable exe 9e4e7f1d55db4c01612f4fb87b648fb0a1edcaf1e57f7ae41919d029196d41f9

  
URLhaus
https://urlhaus.abuse.ch/url/368711/
  
Dropping
MD5 956629bae3679b90a4802b64ee2b3640
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9e4e7f1d55db4c01612f4fb87b648fb0a1edcaf1e57f7ae41919d029196d41f9

Comments