MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c30180548ff09f34b7ae212ecb0bb974d713aa7b88ec4765cdffb460aa2948f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 5 Yara Comments

SHA256 hash: 0c30180548ff09f34b7ae212ecb0bb974d713aa7b88ec4765cdffb460aa2948f
SHA1 hash: a9bdbbfc226602de3634fc76621352770b7d6a5d
MD5 hash: 8bfc216cba407f0fb3f5a894905eb278
File name:REQUEST FOR A QUOTATION 송부 드립니다.IMG
Download: download sample
Signature GuLoader
File size:1'245'184 bytes
First seen:2020-05-22 09:53:37 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:gVSseUfDUOOMpymP7HdaGC1yL45vUXXul2D5XjrmOjTUwULMW6HXpUf2h:eS8fpbMH1yYvUXXulWBiOMKHXpUf
TLSH 63452A669668F132E914CAF53AA4D3784679AC305A12C807F6CC3B1F4FFABC1A45171B
Reporter @abuse_ch
Tags:geo GuLoader img KOR


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: sala.com
Sending IP: 173.82.95.191
From: 최 현종 배상 <herzog@pearlnwalters.us>
Subject: REQUEST FOR A QUOTATION 송부 드립니다
Attachment: REQUEST FOR A QUOTATION 송부 드립니다.IMG (contains "ORDER.exe")

GuLoader payload URL:
http://37.72.175.206/bin_wbVGYxNay136.bin

Intelligence


Mail intelligence
Trap location Impact
Global High
# of uploads 1
# of downloads 20
Origin country FR FR
ClamAV SecuriteInfo.com.Trojan.Siggen9.48537.9372.4387.UNOFFICIAL
VirusTotal:Virustotal results 18.03%
ReversingLabs :No data

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 0c30180548ff09f34b7ae212ecb0bb974d713aa7b88ec4765cdffb460aa2948f

(this sample)

  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment

Comments