MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21d317f31a4966f7f6edbb67e27862b0e6b11fcb22b3214031ea1d6f60b7a547. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21d317f31a4966f7f6edbb67e27862b0e6b11fcb22b3214031ea1d6f60b7a547
SHA3-384 hash: e3cceee796ec1be03a36f35d62736eb7fcfd4c65ffa7335ef2cf13ee753ae46878495c800ab39f1c3c8739a096a22d15
SHA1 hash: 634a406e168c268c08efcb8dd102a44f6c0aaa95
MD5 hash: 14f7e47200c00cc15a2ab0e3966af1be
humanhash: steak-mobile-kitten-nineteen
File name:SWIFT TELEGRAPHIC TRANSFER REMMITANCE COPY - INSTANT SINGLE CUSTOMER CREDIT 20200505 M.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:28'145 bytes
First seen:2020-05-06 09:30:35 UTC
Last seen:2020-05-06 12:32:41 UTC
File type: rar
MIME type:application/x-rar
ssdeep 768:DDz1I4VbpDKtFNsHsgIjuoUwFPDTt8eIO4oxqya:vzjbpDK3Syf7Tt8lr
TLSH 19C2E0A8480FF05B3F7C7C159BB7B7D90F9E6E6900A06C2F8609045A8BA995DD4B5823
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email
From: "Sofia Svetlana" <sofia.svetlana@caspiex.com>
Received: from box.caspiex.com (unknown [128.199.50.151])
Date: Wed, 06 May 2020 01:20:35 -0700
Subject: payment advice
Attachment: SWIFT TELEGRAPHIC TRANSFER REMMITANCE COPY - INSTANT SINGLE CUSTOMER CREDIT 20200505 M.rar

Intelligence

File Origin
# of uploads :
2
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 09:35:31 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 21d317f31a4966f7f6edbb67e27862b0e6b11fcb22b3214031ea1d6f60b7a547

(this sample)

GuLoader

Executable exe f85b3852381cfbabd654be01a21ffbb798a0feaa3f360fff66f27d499c174898

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f85b3852381cfbabd654be01a21ffbb798a0feaa3f360fff66f27d499c174898

Comments