MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 313435c98072db041587643ea7bf8c654de0610f6a0530862ba633c9f7163f18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 313435c98072db041587643ea7bf8c654de0610f6a0530862ba633c9f7163f18
SHA3-384 hash: 1ffada557fe1e4526f51eaa7b2f9144bf61913cf992affc5d964ac3b975af918a2fe65361661a1d69fa050e8ee34af62
SHA1 hash: e102e6792a22bc760302ba022bff56d8729c6959
MD5 hash: 357478b65cae6191783d97abc7d21e3b
humanhash: steak-echo-bravo-pluto
File name:release messages.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-27 18:26:18 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:KtVQnQUzqKSyhLLXI+CPMX1XzrA4GkuDo53dnddrofR98GNe:KsQoqPye+SMRzKpo5NndSfx
TLSH A64563127EE66C7DD18979F16C9568A62A162C10BF04176F32C9FBBD33318E12CA171B
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: slot0.boellhof.com
Sending IP: 45.95.169.21
From: Mail Server <admin@mailbox.com>
Subject: You have pending messages, release now
Attachment: release messages.img (contains "account statement.exe")

GuLoader payload URL:
http://185.205.209.166/wext/Rem-Stub23_tkxlq56.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.NetWire-7917271-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 18:37:13 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 313435c98072db041587643ea7bf8c654de0610f6a0530862ba633c9f7163f18

(this sample)

GuLoader

Executable exe fe0e6e3be607ade9869e9d5a06c87f2485aaf35a29691f74354d7e6a386e711a

  
URLhaus
https://urlhaus.abuse.ch/url/369580/
  
Dropping
MD5 31a3161bd46458175f1594173b694edd
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fe0e6e3be607ade9869e9d5a06c87f2485aaf35a29691f74354d7e6a386e711a

Comments