MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ffda457adf571b7095200f9aaceab489d7d19ddb46d0f42aa74e72bfa818e8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ffda457adf571b7095200f9aaceab489d7d19ddb46d0f42aa74e72bfa818e8c
SHA3-384 hash: 3ce1d417ad0a82867aaef5d88280428d08f66f34ae1bc30d133391b488e4d89acb27ee186af6adf439fa3f135fc391b5
SHA1 hash: 8cabfb5b5df325987db52665b3c25f134b9171f9
MD5 hash: 5dd9b23d07c1c5f094d0ce3b7c34f130
humanhash: mobile-charlie-pizza-johnny
File name:Payment Advice - AdviceRefG20755400121.pdf.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:29'992 bytes
First seen:2020-05-12 16:29:05 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 768:9zo0AwwNULjfuQVhKCseUe7lg+ixhtYgKH0BPKgEGLP4LLJJJ:KwwNULjhhKCo6chyglBled
TLSH B4D2E16FC2E1839804A43EB883BCE5D3CADEBC904A5E5A680D5C1949C5E776CCF89C75
Reporter abuse_ch
Tags:GuLoader gz HSBC


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: host.sarmcol.com
Sending IP: 199.217.117.157
From: advising.service.56028822.518660.1539198682@mail.hsbcnet.hsbc.com
Reply-To: robles@ammeraalbeltechusa.info
Subject: Payment Advice - Advice Ref:[G20755400121] / ACH credits / Customer Ref:[HSBC/FT/006-B] / Second Party
Attachment: Payment Advice - Advice RefG20755400121.pdf.gz (contains "Payment Advice - Advice RefG20755400121.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 16:36:46 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d762iv5n6vy3ocksad42vtvljcox2go5wrwq6qvkottsx6ubr2ga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 1ffda457adf571b7095200f9aaceab489d7d19ddb46d0f42aa74e72bfa818e8c

(this sample)

GuLoader

Executable exe e92e8fd2f291f75954d7417f414bb08e8fd5b015773798ab9743426685dab322

  
Dropping
MD5 80c95782f462c61246a9558506811647
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e92e8fd2f291f75954d7417f414bb08e8fd5b015773798ab9743426685dab322

Comments