MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c30180548ff09f34b7ae212ecb0bb974d713aa7b88ec4765cdffb460aa2948f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0c30180548ff09f34b7ae212ecb0bb974d713aa7b88ec4765cdffb460aa2948f
SHA3-384 hash: 58a5b2b9f220a31c98be64351c1693edb2dae101b17fe96890b228e1198d6593b66cdcca90f284c8d6c3ab165c30aff3
SHA1 hash: a9bdbbfc226602de3634fc76621352770b7d6a5d
MD5 hash: 8bfc216cba407f0fb3f5a894905eb278
humanhash: juliet-pluto-charlie-mississippi
File name:REQUEST FOR A QUOTATION 송부 드립니다.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-22 09:53:37 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:gVSseUfDUOOMpymP7HdaGC1yL45vUXXul2D5XjrmOjTUwULMW6HXpUf2h:eS8fpbMH1yYvUXXulWBiOMKHXpUf
TLSH 63452A669668F132E914CAF53AA4D3784679AC305A12C807F6CC3B1F4FFABC1A45171B
Reporter abuse_ch
Tags:geo GuLoader img KOR


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: sala.com
Sending IP: 173.82.95.191
From: 최 현종 배상 <herzog@pearlnwalters.us>
Subject: REQUEST FOR A QUOTATION 송부 드립니다
Attachment: REQUEST FOR A QUOTATION 송부 드립니다.IMG (contains "ORDER.exe")

GuLoader payload URL:
http://37.72.175.206/bin_wbVGYxNay136.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.48537.9372.4387.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 11:02:07 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 0c30180548ff09f34b7ae212ecb0bb974d713aa7b88ec4765cdffb460aa2948f

(this sample)

GuLoader

Executable exe 47f80b494b4feb2ae4e346836ebe6e4b1b8137e7c20ff4668c020e35e4f45000

  
URLhaus
https://urlhaus.abuse.ch/url/366495/
  
Dropping
MD5 ecf8a7ca0389a689a74814220e7cd703
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 47f80b494b4feb2ae4e346836ebe6e4b1b8137e7c20ff4668c020e35e4f45000

Comments