MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0715cda8a36e88fd3292d68b3070bac566e977747ef1eab23380e83e8c7a9b48. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0715cda8a36e88fd3292d68b3070bac566e977747ef1eab23380e83e8c7a9b48
SHA3-384 hash: b979b2342b22f3a9edcac15fc81d3f2b1aff10a55a9ff2f64201f0bd12a73acccfbddec266e9d138d5db88030681a3ca
SHA1 hash: df48b20748c827f3b53a70079dd70d8717297978
MD5 hash: b71466702d04ada0b4465f6514df2819
humanhash: south-seven-hawaii-equal
File name:Requested Materials List_20200429_1..rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:22'050 bytes
First seen:2020-08-14 09:35:52 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:Ek2kzhEI8mqLijxYdoXJmTU1CWip0SjlFX9ZaxOZiXYkP6lGuPMdT944v1L1f:EqcmqeFcBYG0kN7kPWPMfJN5f
TLSH 7CA2DFAFA07FC021F79F366157A8BE8E1E83B8EB57275F1567B3C119402120B553D484
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

From: Komat Korea ltd <info@uk.flightmax.nl>
Subject: Urgent production request
Attachment: Requested Materials List_20200429_1..rar (contains "Fimrecellerneha4.exe")

GuLoader payload URL:
http://ilobabascity.webredirect.org/uploud/5bab0b1d864615bab0b1d864b3/bin%20K_hfbOkwSdoC13.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
194
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0715cda8a36e88fd3292d68b3070bac566e977747ef1eab23380e83e8c7a9b48/
Threat name:
Win32.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-14 09:37:07 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a4k43kfdn2ep2mus22fta4f2yvtos53up3y6vmrtqdud5dd2tnea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0715cda8a36e88fd3292d68b3070bac566e977747ef1eab23380e83e8c7a9b48

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 0715cda8a36e88fd3292d68b3070bac566e977747ef1eab23380e83e8c7a9b48

(this sample)

GuLoader

Executable exe e8ce2fc9936957e5562804f9e72a2e0f96b680605947ab9ea9c881548aafd6df

  
URLhaus
https://urlhaus.abuse.ch/url/432984/
  
Dropping
MD5 2e9154cd709eaf31c9774880f2df0728
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e8ce2fc9936957e5562804f9e72a2e0f96b680605947ab9ea9c881548aafd6df

Comments