MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29963f2b6f3de89f0ba6e30ca138d5846241eb4acbd3e30bea4896d148b7b2b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29963f2b6f3de89f0ba6e30ca138d5846241eb4acbd3e30bea4896d148b7b2b7
SHA3-384 hash: c71f1beec6c7380ede314bd9bb0260012120d92b47d368a49cf670f507885e228c2433e327a7795a25ce7be9a52584ef
SHA1 hash: 31cb56934cf2130ddc6115d5a6f1708c266cfe4b
MD5 hash: 17824d81e04994148b1574bb6864e98f
humanhash: missouri-mike-king-carbon
File name:10246_08062020_055027280XXXX.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:33'345 bytes
First seen:2020-06-09 11:54:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:kLYv7ucXPk0cwHru+ib9A+WkKBYMQkBKC5jQ6G9l4nHAM:kLUjXPNjHrhib6+UmNKGCngM
TLSH 19E2F1FB9B12DEFED5F939BCD12EC4D0FC14A20D705079E69CA8CD92249A0A9EC35550
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: equitybank.co.ke
Sending IP: 103.207.38.152
From: Customercare <customercare@equitybank.co.ke>
Subject: EQUITY STATEMENT REPORT
Attachment: 10246_08062020_055027280XXXX.zip (contains "10246_08062020_055027280XXXX.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1qbvfM809NHhOyoFvYB9J50s9bL_2w_jK

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Trojan.lm.30176.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 09:54:27 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fgld6k3phxuj6c5g4mgkcogvqrred22kzpj6gc7kjclncsfxwk3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 29963f2b6f3de89f0ba6e30ca138d5846241eb4acbd3e30bea4896d148b7b2b7

(this sample)

GuLoader

Executable exe f1c48eb812cfadfaf6e319ab425cb729a6ad02c2c3b88b726839d4888d0cf6ff

  
URLhaus
https://urlhaus.abuse.ch/url/384564/
  
Dropping
MD5 54b82b5d37e82526d5a8a4b7ad84414a
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f1c48eb812cfadfaf6e319ab425cb729a6ad02c2c3b88b726839d4888d0cf6ff

Comments