MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0dcf44808264bc9d073b101bdda365e2efcfe4bdd549317e12eb49e578472a21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0dcf44808264bc9d073b101bdda365e2efcfe4bdd549317e12eb49e578472a21
SHA3-384 hash: f69ce3bf6b0d4d05d84be1f86d085f57b8b7927482538f78f86dcddbb2cc03b289935f6b730369d2de37aae74a996270
SHA1 hash: de044657e6990560f182303ccc511474dd6110eb
MD5 hash: bc85e11bd9d1bcf26450b150d18e41c3
humanhash: september-solar-oxygen-idaho
File name:RFQ_V40795.pdf..img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-10 06:48:17 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:TBXUcqG0jzKr2eaKpNKqHd0mo4HO2N/J5Wmd:9r0PC2e1QsW2FJ5WC
TLSH 15455B2B1E189953E06087B02AA392A167257D2855057F473E4C6F1DEF33AC2BDE371A
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server.ecomotorhk.com
Sending IP: 162.144.56.225
From: Andy Chung (RINNO ALUMINUM CO., LTD) <chy5304@daum.net>
Subject: Request for Quotation - V-40795
Attachment: RFQ_V40795.pdf..img (contains "order.exe")

GuLoader payload URL:
http://149.255.36.133/bin_PqLAqQjAza233.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Malwarex-8014471-0
Create hunting rule

Win.Malware.Malwarex-8014474-0
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 06:50:08 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bxhujaecms6j2bz3can53i3f4lx47zf52vetc7qs5ne6k6chfiqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 0dcf44808264bc9d073b101bdda365e2efcfe4bdd549317e12eb49e578472a21

(this sample)

GuLoader

Executable exe 163b0dbdbeb27d581695908c409f25a926613547da8cc08e844e2a93307bd9aa

  
URLhaus
https://urlhaus.abuse.ch/url/378987/
  
Dropping
MD5 4ac6f697cf1346c51c53cf6e7e602df1
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 163b0dbdbeb27d581695908c409f25a926613547da8cc08e844e2a93307bd9aa

Comments