MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2786efe3773e80f8c604fcc48b4f24911d86c7d5b1df5d19c4e17b1002255e64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 3 Yara Comments

SHA256 hash: 2786efe3773e80f8c604fcc48b4f24911d86c7d5b1df5d19c4e17b1002255e64
SHA1 hash: 78bf12da0283d666144f35bfa22a3b65b1e7929f
MD5 hash: 1558c0c75be9ddfc0d9a6b3a72a12ed3
File name:ID00501Q0395524IDJKT_pdf.exe
Download: download sample
Signature GuLoader
File size:90'112 bytes
First seen:2020-05-22 10:15:26 UTC
Last seen:2020-05-22 10:52:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4eb9e228ad2d938db0f96c7fd5002208
ssdeep 768:V84DterE6ZaeSnpiZ2ClZq50qAAQLwoPSq8Njppa38DT3N8BrlC7INGB:2Yle0iZKm3A0wgSq8pppaPlJ+
TLSH AF933901F850ECB6ED104EF14E614AD4056FBC791A290B2B34987F9D7B37EE15A6132E
Reporter @abuse_ch
Tags:exe GuLoader SCB


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: 167jiv71v.ni.net.tr
Sending IP: 95.173.179.167
From: Standard Chartered Bank <send@asmobilya.com.tr>
Subject: SUBJECT:Advice from Standard Chartered Bank
Attachment: ID00501Q0395524IDJKT_pdf.gz (contains "ID00501Q0395524IDJKT_pdf.exe")

GuLoader payload URL:
https://fvkreklam.com/my%20okao_OExXxsd33.binhttps://cmdtech.com.vn/my%20okao_OExXxsd33.bin

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 22
Origin country US US
ClamAV SecuriteInfo.com.Variant.Ursu.878098.29590.5300.UNOFFICIAL
VirusTotal:Virustotal results 34.25%
ReversingLabs :No data

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 2786efe3773e80f8c604fcc48b4f24911d86c7d5b1df5d19c4e17b1002255e64

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments