MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a31538fdbf79faacc53dbf634a2193c20b4c2a0e6314302c3aa8f719ff391ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a31538fdbf79faacc53dbf634a2193c20b4c2a0e6314302c3aa8f719ff391ef
SHA3-384 hash: 638dc76571ef6c23285331b3346e391c036a08e827b730daec41380f584160087bdcc1bb56f48acb84205ad29e3e7b33
SHA1 hash: d59a8de1a8f739cbc00b441ff0ffaa6502feaa63
MD5 hash: b0a2323bd699882c6bc0a413e506dd5c
humanhash: thirteen-alabama-hydrogen-maryland
File name:POSSIBLE P.O.pdf.z
Download: download sample
Signature GuLoader
Create hunting rule
File size:18'764 bytes
First seen:2020-10-05 12:09:56 UTC
Last seen:2020-10-05 12:10:19 UTC
File type: zip
MIME type:application/zip
ssdeep 384:TweJ0LWouOKJaStmBtFxbCCaneKlbP+rMNogsAYWM:T50ioLKJzKXtKNm4NogsA7M
TLSH A682D0308B45BBED059F2279A5164FF1980BC4CCB5231C6EA40FDEA996860BCBD8CD1D
Reporter abuse_ch
Tags:GuLoader z


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: sipau1-19.nexcess.net
Sending IP: 103.242.92.61
From: DAVID HALE <pranav@sublimeoptics.com>
Reply-To: company_purchases01@mail.com
Subject: Possible PO
Attachment: POSSIBLE P.O.pdf.z (contains "POSSIBLE P.O.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=618391B69828CF46&resid=618391B69828CF46%21119&authkey=AKVlvLg6hEL9KyI

Intelligence

File Origin
# of uploads :
2
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2a31538fdbf79faacc53dbf634a2193c20b4c2a0e6314302c3aa8f719ff391ef/
Threat name:
Win32.Infostealer.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-05 09:52:20 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fiyvhd6366p2vtct3p3djiqzhqqljqva4yyugawdvkhxdh7tshxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/2a31538fdbf79faacc53dbf634a2193c20b4c2a0e6314302c3aa8f719ff391ef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 2a31538fdbf79faacc53dbf634a2193c20b4c2a0e6314302c3aa8f719ff391ef

(this sample)

GuLoader

Executable exe 0da94c587aef560c9ff0d315cff1c1e073f8ab71f31b259cb78bb9c2293ece80

  
URLhaus
https://urlhaus.abuse.ch/url/654588/
  
Dropping
MD5 b07dde80ddc6e6963cf63eb52328df17
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0da94c587aef560c9ff0d315cff1c1e073f8ab71f31b259cb78bb9c2293ece80

Comments