MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e3260ca4d01f04afc383985273b2c6d24984eaf8bee60ab66d2c3b0c73d307e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: 2e3260ca4d01f04afc383985273b2c6d24984eaf8bee60ab66d2c3b0c73d307e
SHA1 hash: 9fb98fde2c7b709b43e9116de2d1fc34b9d2e0e7
MD5 hash: 38f77309631bcf97ff16b7ac6b7b83ad
File name:File.exe
Download: download sample
Signature GuLoader
File size:90'112 bytes
First seen:2020-05-22 09:54:04 UTC
Last seen:2020-05-22 10:52:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e4a86981418e007faf41d6e7b16fed8a
ssdeep 1536:RR5oVKI+ZWU+mZ7gzlwgAhm9VwCnBoCVAt0:D5oVKIO+mJoGm9VZnBX3
TLSH 4B933A217A54DD66D8005FF24F25CA84037FFD3069104B2B62DD3B6C7A33AC5AB613AA
Reporter @abuse_ch
Tags:exe geo GuLoader KOR


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: ns1.sundaehost.com
Sending IP: 203.146.102.27
From: Phillip Kang <Phillip.Kang@francoismarine.co.kr>
Reply-To: yjkang7@chol.com
Subject: Spare parts [예산견적] Offsore-Project(S-007)
Attachment: file.gz (contains "File.exe")

GuLoader payload URL:
http://creativewg.com/aguobodo_kmuDRGDn229.bin

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 23
Origin country FR FR
ClamAV SecuriteInfo.com.Variant.Ursu.878098.31199.10798.UNOFFICIAL
VirusTotal:Virustotal results 28.77%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 2e3260ca4d01f04afc383985273b2c6d24984eaf8bee60ab66d2c3b0c73d307e

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments