MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c778541b86d25b02de8fe0b5eb365d8ae9c262c97b7513ed6c132ba9e805c53. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0c778541b86d25b02de8fe0b5eb365d8ae9c262c97b7513ed6c132ba9e805c53
SHA3-384 hash: bb343417fffff53303ed88db130d2b93235297c678e9cff0f552854b75af642739cb498e8f5aabbcdf6957ecbc1597a3
SHA1 hash: cf1e55da98fae345614c9a2064d9ad6b6b5f1080
MD5 hash: 21db498084927a3758f351531d34c6d1
humanhash: zulu-hydrogen-lemon-missouri
File name:quotation QTN-20-971-JA04Q7_PDF.ace
Download: download sample
Signature GuLoader
Create hunting rule
File size:24'048 bytes
First seen:2020-05-22 06:38:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:50CgfQF+G4y49z+3nZDsy+TqbYYcQCVssyDkxxzNpGGV49s/goynFqSq:507fQFZiz+3nZDUTqbEQesDDkL3GGrLh
TLSH 14B2F1B65F2EC15CF9D35E3A79DBC71243D3B56E5A840E4B20D0D109C46A6224B88EBF
Reporter abuse_ch
Tags:ace GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: lamarchemfg.com
Sending IP: 37.49.230.146
From: sales@lamarchemfg.com
Subject: Urgent Request for quotation DTDC EXPRESS LTD.
Attachment: quotation QTN-20-971-JA04Q7_PDF.ace (contains "quotation #QTN-20-971-JA04Q7..exe")

GuLoader payload URL:
https://hosseinsoltani.ir/chuks%20po_nLatVelbs7.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader33.44472.14266.17895.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 01:06:39 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 0c778541b86d25b02de8fe0b5eb365d8ae9c262c97b7513ed6c132ba9e805c53

(this sample)

GuLoader

Executable exe 7c35438a1fe6165f0a3fe818dbfc1b65fccb7b534b9a2c085b1527a47237eb69

  
URLhaus
https://urlhaus.abuse.ch/url/366437/
  
Dropping
MD5 45de0a88f1fdb9ec5b53af51b4f613b7
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7c35438a1fe6165f0a3fe818dbfc1b65fccb7b534b9a2c085b1527a47237eb69

Comments