MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f4ed6ffb6539e4fd08da57d1d3577180598316972c284d344fb84c1c601a129. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 3 Yara Comments

SHA256 hash: 2f4ed6ffb6539e4fd08da57d1d3577180598316972c284d344fb84c1c601a129
SHA1 hash: af38ab9005998b922e7c791dffceb5b1634496f7
MD5 hash: 9dd792eb5cd0ca8aaf354fb198420913
File name:STOCKHOLM -SE BANK TELEX 32,000 EUROS.exe
Download: download sample
Signature GuLoader
File size:94'208 bytes
First seen:2020-05-23 11:50:46 UTC
Last seen:2020-05-23 13:13:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3485fbe762bc53c3a90f8034b9982d87
ssdeep 768:F3kYJcmdMpv0UnscwuYMxHeCgTH5Oc+1cbdnU2w3Ps9W1QqeQhGj1XixT3kg:hk0dgtnscXYMReRTZlER2wqqepVixDr
TLSH 4E931A6BB940D872E9240EF11A728A585567ECB09D904B0378EE3B6D3E3374E99753C3
Reporter @abuse_ch
Tags:exe GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: biza0.feedtrades.com
Sending IP: 103.124.107.37
From: ACCOUNT9 <contacts@feedtrades.com>
Subject: FWD: RE: WELSFARGO-US BANK TELEX PAYMENT $32,000
Attachment: WIRE PAYMENT- WELSFARGO.IMG (contains "STOCKHOLM -SE BANK TELEX 32,000 EUROS.exe")

GuLoader payload URL:
http://185.205.209.166/wext/Rem-Stub21_xJNEDiadS140.bin

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 23
Origin country US US
ClamAV PUA.Win.Packer.ProtectSharewar-2
PUA.Win.Packer.ProtectSharewar-3
VirusTotal:Virustotal results 38.89%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 2f4ed6ffb6539e4fd08da57d1d3577180598316972c284d344fb84c1c601a129

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments