MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e3a8546773cbaeb38ff464d2b831e4ef4f386d675dcb1e35867bb114d8b31c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e3a8546773cbaeb38ff464d2b831e4ef4f386d675dcb1e35867bb114d8b31c5
SHA3-384 hash: 851a6c9a9880b14fc3f092561b726997d9a7279cd33594a248f93b87279ea36ec42e732a9683939307bf5e50bd8025a3
SHA1 hash: 40972b3fc3c27a52f7e018aedc44a6d93c0fa7a6
MD5 hash: 2bfbe9e0c34220bc7f94491d019af9db
humanhash: victor-don-paris-oregon
File name:ID547-MSC-202041789BL DRAFT.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:58'247 bytes
First seen:2020-05-28 07:22:25 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 1536:IXF3apiSGK8IqJ1mGuInTwvh5K1BnQuKhU:o3bzK8/1mG9wh5qQuWU
TLSH 7343F1D2CEE40CDC943212F137893A0A522501F68A60712079D4CD6EBF6E5EA9DF72B6
Reporter abuse_ch
Tags:GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: merbabu.asiakom.net
Sending IP: 202.51.253.120
From: ID547-MSC IDJKT IMPORT INVOICE <ID547-id.systemautomail@msc.com>
Subject: Notice of Arrival for MSC B/L :MEDUG3735396/MSC CARLA 3/HC009A PACKING LIST
Attachment: ID547-MSC-202041789BL DRAFT.gz (contains "ID547-MSC-202041789BL DRAFT.exe")

GuLoader payload URL:
https://kinansreview.com/build_NEW_gLpjIcLUO232.bin
https://cmdtech.com.vn/build_NEW_gLpjIcLUO232.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Injector.EMDX.28038.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 07:34:10 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 0e3a8546773cbaeb38ff464d2b831e4ef4f386d675dcb1e35867bb114d8b31c5

(this sample)

GuLoader

Executable exe 91317bfa0133687ff1ed62c9f259ffd823a8e64efa34ab6c98ab4e748b497029

  
URLhaus
https://urlhaus.abuse.ch/url/369924/
  
Dropping
MD5 63008a21a92c874863b5fe6b9850a2da
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 91317bfa0133687ff1ed62c9f259ffd823a8e64efa34ab6c98ab4e748b497029

Comments