MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09f7c89a757ab5c3a0112b898be5428c982f8d24cf9fc31225c50feb63c23707. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 09f7c89a757ab5c3a0112b898be5428c982f8d24cf9fc31225c50feb63c23707
SHA3-384 hash: 5fae218a28b6a4b452d0d00b56054e9eac9ec46feeaed7916cf6b55937bf774147ae19b8c0dc487b2398aaf3368e9ad7
SHA1 hash: 4febb774d30987082e0d048dea8791ee14e086fa
MD5 hash: ab93534b5de3779f6b902c167a43bc21
humanhash: stream-princess-november-muppet
File name:Safety Precautions Tips_PDF_.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-04-02 15:18:11 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:/5KNNclYNbcjL+amtoAvo+K7CAvS/6h0bGqjZId2NSA/oHcTD:BsNHcjL4tzoNmAQ6hGrjqpAV
TLSH 2745D312BE90FD50D4044AB09E7A9BEC466AFC319E916A07B5CC3F6E3FB1140BA51B47
Reporter abuse_ch
Tags:COVID-19 GuLoader img


Avatar
abuse_ch
COVID-19 themed malspam distributing GuLoader:

HELO: highrollers.website
Sending IP: 173.254.251.92
From: Dr Peter D. Haytaian <belviewhospital@highrollers.website>
Subject: How to Stay safe Covid-19
Attachment: Safety Precautions Tips_PDF_.img (contains "Safety Precautions Tips_PDF_.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1zmKBkfiG8ycIBu0LtRT6hD285RCFhzBq

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FRR7BA591968FE7.20166.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-04-02 17:09:00 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
14 of 30 (46.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bh34rgtvpk24hiarfoeyxzkcrsmc7djez6p4gerfyuh6wy6cg4dq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 09f7c89a757ab5c3a0112b898be5428c982f8d24cf9fc31225c50feb63c23707

(this sample)

GuLoader

Executable exe fa085719a6b5701dff065332e4fa698b8961acc2883e611576c178cf370eb5d7

  
URLhaus
https://urlhaus.abuse.ch/url/334012/
  
Dropping
MD5 7ba591968fe72137459e109b02b72a2d
  
Dropping
SHA256 fa085719a6b5701dff065332e4fa698b8961acc2883e611576c178cf370eb5d7
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fa085719a6b5701dff065332e4fa698b8961acc2883e611576c178cf370eb5d7

Comments