MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0819eee317ed48fbd180059d835dd52f8c739ff2db64413be1dbf7711194cafd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0819eee317ed48fbd180059d835dd52f8c739ff2db64413be1dbf7711194cafd
SHA3-384 hash: 9ce35827bdf0439cc56773e35f50ea44cef85edd69d54114b9567a3c230f970de0a2ff6fa8f4e9ebb8416ec936d14eb0
SHA1 hash: f69ee6d248e962d4e3a798eeff66a4cf2924b179
MD5 hash: a4bd87b548e2a5520094a4d886e78d6b
humanhash: golf-victor-grey-autumn
File name:DHL_Express_Shipment_Confirmations_CBJ200618092901_44700456XX.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:27'448 bytes
First seen:2021-01-15 07:08:23 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 768:BtROfHb6AEFiZ+rsHGUulL4AkXIz3pDNWbT:Bt0T5EFiZ+3lv7pQ3
TLSH ECC2E08224B16E6391A3BF8BF71598819D3B2D387E1625CE40ADA3BD07C95D0E3E0995
Reporter abuse_ch
Tags:arj DHL GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: vm1752843.nvme.had.yt
Sending IP: 185.244.219.92
From: DHL Express <dhl.Senders@dhl.com>
Subject: DHL Express Shipment Confirmations
Attachment: DHL_Express_Shipment_Confirmations_CBJ200618092901_44700456XX.arj (contains "DHL_Express_Shipment_Confirmations_CBJ200618092901_44700456XX.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=5C346132870D7D54&resid=5C346132870D7D54%21106&authkey=AC7flWDuVyKo3aY

Intelligence

File Origin
# of uploads :
1
# of downloads :
209
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0819eee317ed48fbd180059d835dd52f8c739ff2db64413be1dbf7711194cafd/
Threat name:
Win32.Trojan.Midie
Create hunting rule
Status:
Malicious
First seen:
2021-01-15 07:09:07 UTC
AV detection:
14 of 46 (30.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bam65yyx5vepxumaawoygxovf6ghhh7s3nseco7b3p3xcemuzl6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0819eee317ed48fbd180059d835dd52f8c739ff2db64413be1dbf7711194cafd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

arj 0819eee317ed48fbd180059d835dd52f8c739ff2db64413be1dbf7711194cafd

(this sample)

GuLoader

Executable exe 316ae869254da17770f7f1ad79caefefaedb09ae4c76bd9b26e3f58792dd0bf6

  
URLhaus
https://urlhaus.abuse.ch/url/962433/
  
Dropping
MD5 53652649ce39f68fceb43c38f3c00fdf
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 316ae869254da17770f7f1ad79caefefaedb09ae4c76bd9b26e3f58792dd0bf6

Comments