MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bdc4eeeb3d4c704c9915e97ac2a53211a02c9f45a2c659ae45429a8ee5cd85f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0bdc4eeeb3d4c704c9915e97ac2a53211a02c9f45a2c659ae45429a8ee5cd85f
SHA3-384 hash: fc1d613a2f4f64e87450583fa551921be53d3d0448ee52d929c27e6584a5f729ccb1579be5b43ee499258cb81709575d
SHA1 hash: 5474c0b171719fd62092e9b7a0f2f6e016aa544d
MD5 hash: 18f4e5d343ec5b0696683caf389bd09c
humanhash: stairway-ink-paris-alpha
File name:NTS_eTaxInvoice 26-05-2020·pdf.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:34'284 bytes
First seen:2020-05-26 07:50:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:GlG7pFOVYtnEUJ5fm0mS9kOgDF0IpsQZ9xlF2LTKRF0c:GlG7mynlrfMS9hTIaQj0+Rec
TLSH E5F2F15303CAE534ACCA8C50CAB0BBF7D5F6977246E149AF2CB3C7147119249B2654AF
Reporter abuse_ch
Tags:geo GuLoader KOR zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: vps.cnidcloud.com
Sending IP: 198.38.86.192
From: 국세청 <hometaxadmin@hometax.go.kr>
Subject: 전자세금계산서 발급 메일 안내
Attachment: NTS_eTaxInvoice 26-05-2020·pdf.zip (contains "NTS_eTaxInvoice 26-05-2020·pdf.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1SwseU3gZdT-lnVimozY9cInXIBzO5Ukl

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27245.ZipHeur.HideExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 08:36:39 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
15 of 47 (31.91%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 0bdc4eeeb3d4c704c9915e97ac2a53211a02c9f45a2c659ae45429a8ee5cd85f

(this sample)

GuLoader

Executable exe a7a59d86798f2df99df6adaba2c7713a12fe773b73cf3c4c0ec60e5067136630

  
URLhaus
https://urlhaus.abuse.ch/url/368722/
  
Dropping
MD5 10d59ef8889f48aaae50da3a727c5426
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a7a59d86798f2df99df6adaba2c7713a12fe773b73cf3c4c0ec60e5067136630

Comments