MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0989e0885dee737263617ba6f55779c4b0f02e54586a5b1f139fa3eee1da1a26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0989e0885dee737263617ba6f55779c4b0f02e54586a5b1f139fa3eee1da1a26
SHA3-384 hash: c288a8305a3a7ab1785841881539cf0d096aeea659f69b1a48c8cd73c0bb8675119062e47f9b4b2b01b3bd02c1286138
SHA1 hash: cfadc850071d85c0c7b25add4264fd7083a80c67
MD5 hash: e0fb5f6644b5fa56b9a7696fb582897d
humanhash: harry-saturn-four-single
File name:RFQ89234A_2021_LISTED_ITEMS_DUC_PHUC_IMPORT_EXPORT_CO.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:26'634 bytes
First seen:2021-01-13 20:07:10 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 768:jm8KffCsNcENKKwIifLcusO6+rpIYzqEmHb:yf6seENb0fLQ86uqtb
TLSH C5C2E1D107928F14F3B73B1A8866DEA312E3F4256C612E0D5BAF66C93122749329176D
Reporter abuse_ch
Tags:arj GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail.facetohen.ga
Sending IP: 5.8.93.141
From: Traân troïng <sales.phatdt58@gmail.com>
Subject: REQUEST FOR QUOTATION RFQ#89234A-2021
Attachment: RFQ89234A_2021_LISTED_ITEMS_DUC_PHUC_IMPORT_EXPORT_CO.arj (contains "RFQ#89234A_2021_LISTED_ITEMS_DUC_PHUC_IMPORT_EXPORT_CO.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=A951308400164DD4&resid=A951308400164DD4%21106&authkey=APE43C5aWsOop18

Intelligence

File Origin
# of uploads :
1
# of downloads :
217
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodRar-AIC.21334.18232.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0989e0885dee737263617ba6f55779c4b0f02e54586a5b1f139fa3eee1da1a26/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-13 20:08:10 UTC
AV detection:
9 of 28 (32.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bge6bcc55zzxey3bpotpkv3zysypalsulbvfwhytt6r65yo2dita._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0989e0885dee737263617ba6f55779c4b0f02e54586a5b1f139fa3eee1da1a26

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

arj 0989e0885dee737263617ba6f55779c4b0f02e54586a5b1f139fa3eee1da1a26

(this sample)

GuLoader

Executable exe c65e2de75fb34171072925ff6d7c2a9fa79e5d311c4296dacf7a12d524b4167d

  
URLhaus
https://urlhaus.abuse.ch/url/952172/
  
Dropping
MD5 5a07a1d293ec00ef9f52f9c515c95f57
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c65e2de75fb34171072925ff6d7c2a9fa79e5d311c4296dacf7a12d524b4167d

Comments