MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 228c7493a5078738fa12272778b74c3d732d409fb53a2cda1086b22983dc0046. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 228c7493a5078738fa12272778b74c3d732d409fb53a2cda1086b22983dc0046
SHA3-384 hash: 2a65890334c9700dcf985a55ad1a79f49569d67faab671138f8be769b5ae1720f1b4bd69f13201f93266a650d2594d62
SHA1 hash: d3bac27a3487db4a21c87692fb1a549f84120733
MD5 hash: 036ae43d80abb781d465b5f9a958178a
humanhash: glucose-green-wisconsin-berlin
File name:DHL RECEIPT.pdf.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:42'991 bytes
First seen:2020-06-03 13:30:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:v8wuLaZSen27volQpPzrzVuBARs/d9g868eCEu5TZ4fS2GwTfKPOcKzUgCkfk7uf:UwuL6CeKduBJgpnCxZ4fSJgf4jKIjKvX
TLSH 1213F1B11CDA8ED1FD1A5EB48E1761B6B1014ABDB3C287835CD1635C79DD2C8CB8A463
Reporter abuse_ch
Tags:DHL GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: smtp116.iad3a.emailsrvr.com
Sending IP: 173.203.187.116
From: DHL EXPRESS <notification.protocols@update.com.uk>
Subject: Notice-OVERDUE-DHL
Attachment: DHL RECEIPT.pdf.rar (contains "DHL RECEIPT.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 13:37:21 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ekghje5fa6dtr6qse4txrn2mhvzs2qe7wu5czwqqq2zcta64abda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 228c7493a5078738fa12272778b74c3d732d409fb53a2cda1086b22983dc0046

(this sample)

GuLoader

Executable exe 9daa8e87928b88143b9482b989764524754c86d142027ccaad1fc452f52c1765

  
Dropping
MD5 f0da4e6901bab7958358ebf1d06ec2f9
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9daa8e87928b88143b9482b989764524754c86d142027ccaad1fc452f52c1765

Comments