MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 259ee24655f78dc8318c20a56afe9612be8d2359599eb61cbdb1ade9c8a54c5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 259ee24655f78dc8318c20a56afe9612be8d2359599eb61cbdb1ade9c8a54c5d
SHA3-384 hash: 2f1b9977b9d0757cc766dedaefbd0dd9ec705c44901bc5aa8b3b5b509711679324d3bc0c87df426069127399229ecfef
SHA1 hash: 6cd04744d31c1747c0b08928139b9f42b132ddd1
MD5 hash: 65e0c434c0373ea7095f6a6633752894
humanhash: wisconsin-cola-ceiling-don
File name:Ningbo Zhenhe - 9K Oil tanker - Butterfly valve.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-25 13:31:23 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:ZEleQqBEhsUw0dzKxqeUi5yj0SdfhQxrtFSxf49FOc:5LBE1niqu5evAxYf4u
TLSH E1452CA0F1F4513BD3B7DE708EB282D405BB3D7C2609841B3A4C758E0B7DA04E96A61B
Reporter abuse_ch
Tags:geo GuLoader img KOR


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: navy.com
Sending IP: 173.82.106.230
From: Lee <emil@haroldbray.ga>
Subject: Fwd: Ningbo Zhenhe - 9K Oil tanker - Butterfly valve 견적 요청 건
Attachment: Ningbo Zhenhe - 9K Oil tanker - Butterfly valve.IMG (contains "RFQ.exe")

GuLoader payload URL:
http://37.72.175.206/bin_wbVGYxNay136.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 13:36:43 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
14 of 31 (45.16%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 259ee24655f78dc8318c20a56afe9612be8d2359599eb61cbdb1ade9c8a54c5d

(this sample)

GuLoader

Executable exe 1de9da3a2c6effe9e9eae16a0d70fc19c633e479073f308a666665b0628e866b

  
URLhaus
https://urlhaus.abuse.ch/url/366495/
  
Dropping
MD5 ecfce5d3e49d2ad94acc1f5dd630b2b3
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1de9da3a2c6effe9e9eae16a0d70fc19c633e479073f308a666665b0628e866b

Comments