MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a303830c8dc36a8e24a59d118a697627f3c9fa5a7f8f4f89c13ca3ef7fedd8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a303830c8dc36a8e24a59d118a697627f3c9fa5a7f8f4f89c13ca3ef7fedd8e
SHA3-384 hash: 458f35c4ca7f5bf3cf712aca41f348e95f258577399c588bf1870c0c5126d6f479dd6f5e516e21a2957d1bb72bd1a525
SHA1 hash: 25013e79af4b09ad04aac26e41e074a32b1aa6ea
MD5 hash: 7cbee7cfad9d5c9a5ce2e4801a41a1dd
humanhash: oscar-johnny-colorado-carolina
File name:Xeros_ Scan _ Covid_19_ Urgent_information letter.xls.iso
Download: download sample
Signature GuLoader
Create hunting rule
File size:172'032 bytes
First seen:2020-04-14 09:31:53 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 768:wubeCKUD5F/PATnJEdV9doBnoA2EP8oGXIqZgfCM5jOLAnXGs:l/j5F/PAnJEH9EioGXhmCcOLIXV
TLSH A5F3C221B984FE80C9165AB349F9DAA89403BD349C75364734CD3E1F37771E0BA52B86
Reporter abuse_ch
Tags:COVID-19 GuLoader iso


Avatar
abuse_ch
COVID-19 themed malspam distributing GuLoader:

HELO: oceanic9admin.yourwebhosting.com
Sending IP: 209.59.217.91
From: WORLD HEALTH ORGANIZATION (WHO) <healthcaresupport@who.int>
Subject: URGENT INFORMATION LETTER:COVID-19
Attachment: Xeros_ Scan _ Covid_19_ Urgent_information letter.xls.iso (contains "Xeros_ Scan _ Covid_19_ Urgent_information letter.xls.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1z9rDpAG9J7v4gYIKssrMvqs10iRFm4tI

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.NetWire-7667567-0
Create hunting rule

Win.Dropper.NetWire-7667581-0
Create hunting rule

Win.Dropper.Noon-7667582-0
Create hunting rule

Win.Dropper.LokiBot-7667993-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-14 09:35:31 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
19 of 45 (42.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=diydqmgi3q3krysklhirrjuxmj7tzh5fu74pj6e4cpfd55763wha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso 1a303830c8dc36a8e24a59d118a697627f3c9fa5a7f8f4f89c13ca3ef7fedd8e

(this sample)

GuLoader

Executable exe b33804d1bcadb3c28baad638d82f7510ab66451a5a602978dfa8f629e6bdca05

  
URLhaus
https://urlhaus.abuse.ch/url/340137/
  
Dropping
MD5 455558a703168177855a968577d73afe
  
Dropping
SHA256 b33804d1bcadb3c28baad638d82f7510ab66451a5a602978dfa8f629e6bdca05
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b33804d1bcadb3c28baad638d82f7510ab66451a5a602978dfa8f629e6bdca05

Comments