MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2371512e5a006e4d27e04fdaf3b41205c850869535db847350eddafee5f1bf1d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2371512e5a006e4d27e04fdaf3b41205c850869535db847350eddafee5f1bf1d
SHA3-384 hash: 1e04472e35e95b5bc2a5867fd5d691013c9ef737ba7ebf0c4eec215f1a7e6a7babc49127b3809f76dd91b3ce9eb1192d
SHA1 hash: 542347301a14c2b090b9b509659882f920a92063
MD5 hash: 259c0ee152222c73a06db2a5787d6b6e
humanhash: glucose-alanine-montana-dakota
File name:Product Specification Technical Data.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:308'362 bytes
First seen:2020-10-07 05:00:32 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:9hod8D/xyqWqjvrRcYuexVJi98qQe2ehuMhmshi9wXXRdwa+4ldnVO/IUJZFA:9Vty/mvrRpuebJatQfZqSURdU4ldnVOY
TLSH 72642356EC3686E6D5213DBE2B84D7CE0FDED05A26170F39664AFD27FE476221932002
Reporter abuse_ch
Tags:arj GuLoader


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: Lo Shin Yien <support@stayntechman.com>
Subject: REFERENCE-086156
Attachment: Product Specification Technical Data.arj (contains "Product Specification & Technical Data.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2371512e5a006e4d27e04fdaf3b41205c850869535db847350eddafee5f1bf1d/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 01:06:53 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=enyvcls2abxe2j7aj7nphnasaxefbbuvgxnyi42q5xnp5zprx4oq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2371512e5a006e4d27e04fdaf3b41205c850869535db847350eddafee5f1bf1d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

arj 2371512e5a006e4d27e04fdaf3b41205c850869535db847350eddafee5f1bf1d

(this sample)

GuLoader

Executable exe ee5fd99c7fc747944fc82337291094b744fca1f9f6328551ba0f10a9f025ad52

  
Dropping
MD5 58f24f8254aec1c067afa7c1e00903c8
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ee5fd99c7fc747944fc82337291094b744fca1f9f6328551ba0f10a9f025ad52

Comments