MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2dea4d8d7e8f204ffaed04e03260c51e259084b2a68eb0f7660f9f5dc46941cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2dea4d8d7e8f204ffaed04e03260c51e259084b2a68eb0f7660f9f5dc46941cd
SHA3-384 hash: e8a170223c3eb54be031ac471d8796aad3ee074526dc31c34ad835fa128f85f67ec538bcffb8ceceb0a7ca00ae534c16
SHA1 hash: 9ed3344ed01a866bbe4d930b9fe59ff5498bad75
MD5 hash: 60721a923e12b59ff62e5cf6e659d402
humanhash: network-lion-vermont-mike
File name:Consignment Details.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:32'313 bytes
First seen:2021-05-03 12:52:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:Un6hgyqnbCbBHMDxeg/NwproGx7nK/EiKqYb:UnSs+Hk7/NwpEGFK/EiKqa
TLSH 83E2E11430A94BB7CA8D18FF91BC7CB866063F2457E5870FC5A19D03E981A46FD26735
Reporter cocaman
Tags:DHL GuLoader gz


Avatar
cocaman
Malicious email (T1566.001)
From: "=?UTF-8?B?REhMIEV4cHJlc3MgSU5Dwq4=?= <support@dhl.com>" (likely spoofed)
Received: "from hp0.mxvmno.ml (hp0.mxvmno.ml [164.90.170.237]) "
Date: "3 May 2021 13:04:27 +0200"
Subject: "DHL CONSIGNMENT NOTIFICATION: AWB 9899691012 Clearance Doc"
Attachment: "Consignment Details.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
169
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.__vbaHresultCheckObj.20812.1487.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/2dea4d8d7e8f204ffaed04e03260c51e259084b2a68eb0f7660f9f5dc46941cd
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2dea4d8d7e8f204ffaed04e03260c51e259084b2a68eb0f7660f9f5dc46941cd/
Threat name:
Win32.Trojan.Mucc
Create hunting rule
Status:
Malicious
First seen:
2021-05-03 12:53:08 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fxve3dl6r4qe76xnatqdeygfdyszbbfsu2hlb53gb6pv3rdjihgq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210503-y3lrmesl5n/
Behaviour
Suspicious use of SetWindowsHookEx
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
GuLoader
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2dea4d8d7e8f204ffaed04e03260c51e259084b2a68eb0f7660f9f5dc46941cd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 2dea4d8d7e8f204ffaed04e03260c51e259084b2a68eb0f7660f9f5dc46941cd

(this sample)

  
Delivery method
Distributed via e-mail attachment
  
Dropping
GuLoader

Comments