MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2089ca82a514b0739c0b6201fdcfff92dd8f9d9dfd84d3e015b1e4543e60ac1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2089ca82a514b0739c0b6201fdcfff92dd8f9d9dfd84d3e015b1e4543e60ac1c
SHA3-384 hash: 17508827e5e219798a165ae3b5178dfca245898702844570bb2f17f43ac5a7862b5465bf08884ab1a6ff9afdca66e33d
SHA1 hash: ce9272e3d1b8f5b90f1de09fecb3362fe25a631b
MD5 hash: 3960108bb3b44f6a656a387d6373b9a4
humanhash: moon-papa-blue-wyoming
File name:beneficiary details.Z
Download: download sample
Signature GuLoader
Create hunting rule
File size:22'894 bytes
First seen:2020-05-22 09:57:39 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 384:FdKQ9ZnuLCkF3R7b3jpiuHUun00oNekfoOSqM6gvE54PT35K1uh2WqBMrUvCB:F19s9zjpiuH+5NXfrSP6dYQ1ukWqBCrB
TLSH 0BA2D12EC3AD8EBE8976E2C64D0DED26A0931185E3D1C5655C337C38E6D22895338641
Reporter abuse_ch
Tags:GuLoader z


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: lpbindia.com
Sending IP: 37.49.230.204
From: "Michelle Adalbert" <gautam.maity@lpbindia.com>
Subject: PAYMENT SWIFT
Attachment: beneficiary details.Z (contains "beneficiary details.bat")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1F-2XEdYtJcqVZCfE7hiWB125f8fzm-5d

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Formbook
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 20:44:43 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
15 of 30 (50.00%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

z 2089ca82a514b0739c0b6201fdcfff92dd8f9d9dfd84d3e015b1e4543e60ac1c

(this sample)

GuLoader

Executable exe 7f778b8e3a796983fed9752ce588632eaefcd06d0ddc0eb346869829a14fdd00

  
URLhaus
https://urlhaus.abuse.ch/url/366459/
  
Dropping
MD5 0a537d6cda15fd1f2e99ba2ac41188ee
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7f778b8e3a796983fed9752ce588632eaefcd06d0ddc0eb346869829a14fdd00

Comments