MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 106a38e445a1accaf82e376c3a58a4e1e391e1baecb77f2aa82b4d3f4862e9d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 106a38e445a1accaf82e376c3a58a4e1e391e1baecb77f2aa82b4d3f4862e9d0
SHA3-384 hash: 0aa68bf45bc85637bf121e153243d77a840da35a9ed3b41901609871122450de5ace4613b43d3865084f957656e64be3
SHA1 hash: 5f7123222bf930b985abe23bc6f9eec7d821dfff
MD5 hash: 659d02e73901a83ca7179ed45d581520
humanhash: ceiling-oxygen-coffee-twelve
File name:SWIFT COPY_MT.001
Download: download sample
Signature GuLoader
Create hunting rule
File size:35'211 bytes
First seen:2020-06-02 11:15:32 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:ZeHi6NErSX+Sb6qY7hjKOJXRk1KHMoZNvXlOvCMAPhZo+3Z0uyY8M5M/:ZefNErSuau7xTJBk1KHjEShJ3Fy9M5A
TLSH 3BF2F123CA3AF69D7BB17795406E046374E90838626D831B7D4DE8A361E272C437729F
Reporter abuse_ch
Tags:001 GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

From: "Mahmoud.samanoudy" <Mahmoud.samanoudy @elcosteelgroup.com>
Subject: Advance Payment
Attachment: SWIFT COPY_MT.001 (contains "mhlamu.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1tsTQRLociE3GjnaVy6plZ1LWlGi3QARi

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Occamy
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 13:31:37 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cbvdrzcfugwmv6bog5wduwfe4hrzdyn25s3x6kvifngt6sdc5hia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 106a38e445a1accaf82e376c3a58a4e1e391e1baecb77f2aa82b4d3f4862e9d0

(this sample)

GuLoader

Executable exe 1ae403046763d7ad06e583b4b69d90bec18daab8d68255e93cfe2f58d5bd8ddd

  
URLhaus
https://urlhaus.abuse.ch/url/374275/
  
Dropping
MD5 e06d48ef8e03a0e8d5840c12cc13dba8
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1ae403046763d7ad06e583b4b69d90bec18daab8d68255e93cfe2f58d5bd8ddd

Comments