MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b3d7984eff5181bfc3c2e0479b5aa502e396817cd69aa1ce72837556dd3ae01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b3d7984eff5181bfc3c2e0479b5aa502e396817cd69aa1ce72837556dd3ae01
SHA3-384 hash: aab280a1b78eb864bd423a2a06880ae6101a1e757bc9f62dcbaf81e2e9f1885d0ae9d1e5ab6fa797f4da77a66a19a82d
SHA1 hash: a88bc3f8164943f423494a7e340fef04bfb49a97
MD5 hash: 0485455f71e29e2b675128e8a861bda1
humanhash: seven-tennis-lion-romeo
File name:Order118030620.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:73'857 bytes
First seen:2020-06-03 13:28:59 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:L+nFvuJGH8NASlpYuDCP7/WsUw9N/xP4ZGySen8oCxUFUHRoud:iFvuJGcNAkYYCP7/1UCvMGy5n8t0U+ud
TLSH 737312BBE1627D75C305787DD6062C58189A0D18043C09BAC37BFFBB3F988257AC1229
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-m24146.qiye.163.com
Sending IP: 220.194.24.146
From: Sales <shlaien@laien.cn>
Subject: New Order (top urgent)
Attachment: Order118030620.zip (contains "Order118030620.exe")

GuLoader payload URL:
http://legalpros.lawyer/wwed/biggrc_UZMAI73.bin
http://b2ainfotech.com/bwed/biggrc_UZMAI73.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.NetWire-7996875-0
Create hunting rule

Win.Malware.Razy-7997182-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 13:37:21 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dm6xtbhp6umbx7b4fychtnnkkaxds2axzvu2uhhhfa3vk3otvyaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 1b3d7984eff5181bfc3c2e0479b5aa502e396817cd69aa1ce72837556dd3ae01

(this sample)

GuLoader

Executable exe f3418e9ec01f4116a2ae079c709ee3c20455d66861951751474dbeb49ab75c26

  
URLhaus
https://urlhaus.abuse.ch/url/376190/
  
Dropping
MD5 03d84c2efb63b002e4e3061ef2a37598
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f3418e9ec01f4116a2ae079c709ee3c20455d66861951751474dbeb49ab75c26

Comments