MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2556b14cc704b771a75923d97fda58530248fdf2c0a89ff28a2df61f60f52662. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2556b14cc704b771a75923d97fda58530248fdf2c0a89ff28a2df61f60f52662
SHA3-384 hash: bcc95d8d3cfd7d27beb4b9cfbce65201c66dff362951a1d0e4934cf59b5a922e25056de250e1be5b286508f07ffa56cc
SHA1 hash: 1b3c6ff6cf0edcc27448b1cb21ef7d809d892c4b
MD5 hash: b0442c97ecce0262d09c2703f3141b20
humanhash: minnesota-oxygen-equal-november
File name:Rechnung1.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:30'134 bytes
First seen:2020-05-21 19:28:55 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:SYXrbzhi5TAbw2rL47zypGc8ytpH4TBUlG9/bvk+bpgwWmC4s0DtgKIAcnexbgWs:SY7/hidAbluapOBJTgOC4LItMbtKKo1
TLSH 2AD2F1A57C2B37A0C55989FD124E56C0B963AFE16A10628BC7BE04F5CC8B1BE51CE31C
Reporter abuse_ch
Tags:DEU geo GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mxout02do.versatel.de
Sending IP: 89.245.129.165
From: kidrth@versanet.de <kidrth@versanet.de>
Reply-To: kidrth@versanet.de <kidrth@versanet.de>
Subject: AW: AW: Zahlungsbeleg und Auftragsbestätigung 21-05-20 Rechnung_20-613129926-001
Attachment: Rechnung1.zip (contains "Rechnung.exe")

GuLoader payload URL:
http://156.96.118.179/RSol.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Sanesecurity.Malware.25744.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 19:35:38 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 2556b14cc704b771a75923d97fda58530248fdf2c0a89ff28a2df61f60f52662

(this sample)

GuLoader

Executable exe e180e8ae6521bb30a7baaeaf95c7583815922ef07c695c5a6fc7c123b6442d7b

  
URLhaus
https://urlhaus.abuse.ch/url/366085/
  
Dropping
MD5 6c9affa92ea3262897f0df540b61e711
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e180e8ae6521bb30a7baaeaf95c7583815922ef07c695c5a6fc7c123b6442d7b

Comments