MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e16ee048ea3dc3832d7acdb5f8c9fd14ae46b8dd55364682c87296336b8326c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 5 Yara Comments

SHA256 hash: 2e16ee048ea3dc3832d7acdb5f8c9fd14ae46b8dd55364682c87296336b8326c
SHA1 hash: 2a4f6b4f987c926def1b5a3ddbd4537bb59140e9
MD5 hash: 280dde48ea4cadd257c85cc51a624426
File name:Drilnin.rar
Download: download sample
Signature GuLoader
File size:23'989 bytes
First seen:2020-05-22 10:16:18 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:unxC71xpSSVK+xGZ66EAViZvt1wTGY4EF9LOs8vqYbAsHYMhe6VtJC+uyP5C83Ty:8kZ7wFEisvT84EFROstYR4ge6bJPuyPQ
TLSH 3BB2E1904AD7C950C709EE1F3A3B84BABBDD0CD9496D94712387C5C334229AE1E9AF49
Reporter @abuse_ch
Tags:GuLoader rar


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: server.example.com
Sending IP: 103.114.106.250
From: Jason Bourne <admin@mogioan.cf>
Subject: FWD:Final PI for remittance
Attachment: Drilnin.rar (contains "Drilnin.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1ovKVpChESCpaA_RXMgvjSy3b7a6K7NNd

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 22
Origin country US US
ClamAV No detection
VirusTotal:Virustotal results 16.39%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 2e16ee048ea3dc3832d7acdb5f8c9fd14ae46b8dd55364682c87296336b8326c

(this sample)

  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment

Comments