MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a292683292cfbc5be87371a34a163b3d29dc6ff582c87625c0997b3dd31b777. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a292683292cfbc5be87371a34a163b3d29dc6ff582c87625c0997b3dd31b777
SHA3-384 hash: 2203f52c24cf52aee08b6b5e3e75bc01f4f74202c7ef53c5acb5c92b8fb762b0a82eae8b96cbcc1313dce01158f5f97a
SHA1 hash: f01a77782fe262f8fded19f025a509d67f6e90a9
MD5 hash: dedfe963911bfe4788ba12c7ec586ece
humanhash: rugby-fruit-uniform-high
File name:new order.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:25'220 bytes
First seen:2020-03-30 11:47:46 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 384:tZlshbfZZj0idk/ofaj+cHmjONSkjtaIks/0yKP28IHtpfjpYJ57+HWETHcuwQlS:2bf3j5zfajJQ+SBA5qFatRjqMvT8uwQI
TLSH 29B2D140F0DB9E757FCADB110791819D36363112533F1AD1D9AF23A326C924D49BBB26
Reporter abuse_ch
Tags:COVID-19 GuLoader gz


Avatar
abuse_ch
COVID-19 themed malspam distributing GuLoader->AgentTesla:

HELO: sg2nlshrout01.shr.prod.sin2.secureserver.net
Sending IP: 182.50.132.193
From: info <info@suntecmedical.com>
Subject: New order - Suntec Medical (Covid-19)
Attachment: new order.gz (contains "new order.exe")

GuLoader payload URL (AgentTesla):
https://drive.google.com/uc?export=download&id=1qnQeDhk__jgArpg3JU8NQtjQEDFu5Xnj

AgentTesla SMTP exfil server:
smtp.yandex.com:587 (77.88.21.158)

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-03-30 12:35:26 UTC
AV detection:
20 of 47 (42.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=biusnazjft54lpuhg4ndjildwpjj3rx7lawioys4bgl3hxjrw53q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 0a292683292cfbc5be87371a34a163b3d29dc6ff582c87625c0997b3dd31b777

(this sample)

AgentTesla

Executable exe 3b579b5c48b467cb0e3a3b28773a63ce90b11a87f4baba15b98d0af36291a314

GuLoader

Executable exe 1df1f90da9a07dfe25f0368fc24830fd1513e938c590e9ca6cfbe422dcfedc38

  
URLhaus
https://urlhaus.abuse.ch/url/331958/
  
Dropping
MD5 f88785a5cd52bb711ad05f2962338d28
  
Dropping
SHA256 1df1f90da9a07dfe25f0368fc24830fd1513e938c590e9ca6cfbe422dcfedc38
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1df1f90da9a07dfe25f0368fc24830fd1513e938c590e9ca6cfbe422dcfedc38

Comments