MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 239d728341174c5bf888a596090db66e69dab773ea71a619ec6acc385c5f3bb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 239d728341174c5bf888a596090db66e69dab773ea71a619ec6acc385c5f3bb7
SHA3-384 hash: 3ac19ed710ba68b0f0382bda541c2ea59f3496d1743f4e59733fba3a01f88a95de27ae5aac5b94a001fea08d06d2b702
SHA1 hash: b7829b99061a0140e69753cb9e887f0957a6c149
MD5 hash: ca8760da553a493c723845a870619f00
humanhash: autumn-november-georgia-yellow
File name:tt_copyy.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:42'120 bytes
First seen:2020-06-02 11:00:48 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 768:VZiyO/HdTECvQDDaqUaR+d0xfrzpOSdzfM0AWC4Y//ByIZLLr:+5BUDRk0WS5fMaC4iUUnr
TLSH 7513F13998A0642FAC0F98D23AE4B16DD5C2D4438A14D9E16BA8DA9F849EF1E041D637
Reporter abuse_ch
Tags:GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: worldwide-logistics.cn
Sending IP: 103.99.1.144
From: Worldwide Logistics Co.,Ltd. <sha.ops8@worldwide-logistics.cn>
Reply-To: Worldwide Logistics Co.,Ltd. <noreply@domain-admin.com>
Subject: RE: RE: Re[2]: Re: 20041971 振华下单 转发: 1002000308 1002000308-200324-01 巴基斯坦 CIF 海运 询价单
Attachment: tt_copyy.gz (contains "tt_copyy.scr")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1059Hs1HiFa0HG4H69_02T1kTYmz8V7Ek

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Npe
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 02:36:26 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eooxfa2bc5gfx6eiuwlasdnwnzu5vn3t5jy2mgpmnlgdqxc7ho3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 239d728341174c5bf888a596090db66e69dab773ea71a619ec6acc385c5f3bb7

(this sample)

GuLoader

Executable exe 2a1dd64638dac970b58a8dc939415fcc2a4532211295f1c72370df4df91447e1

  
URLhaus
https://urlhaus.abuse.ch/url/373525/
  
Dropping
MD5 a79a189da67ec2790a6b6f80e51de9b3
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2a1dd64638dac970b58a8dc939415fcc2a4532211295f1c72370df4df91447e1

Comments