MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33773ec8398380a43403e2670bbf33406d9e050f4f6605f3168e4a09a8fbe8f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 33773ec8398380a43403e2670bbf33406d9e050f4f6605f3168e4a09a8fbe8f0
SHA3-384 hash: 4c4a90802cf481786f6797fd04a4bb3013e6c30cc44c390f5b292f1c5d3730f2cede9f00e9193aa1715815b79553be04
SHA1 hash: 619bcec448a672bf1ffa992134c11ed86f6858f4
MD5 hash: 5d04e1c5770d669413ba42c56be9b8cd
humanhash: connecticut-lake-chicken-mockingbird
File name:AS Alexela Terminal.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:29'797 bytes
First seen:2020-05-26 07:30:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:iUF9Jk0IiQ9qCuWbjxwplMU883WCHn6RHOd1CK4t3k99CyHkn2ZS4VheAzQeWwte:ZJpCjxeH88ln6RHO3Kt0ekfS4DbxoKb+
TLSH 55D2E0209D3C08AEC8D5F8ED2C6343237D79ED59CE7C153165816AE42F641710D36B67
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: 162-241-215-51.unifiedlayer.com
Sending IP: 162.241.215.51
From: terminal@alexelaterminal.ee
Reply-To: terminal.alexelaterminal@email.com
Subject: AS Alexela Terminal // pakkumise taotlus //
Attachment: AS Alexela Terminal.zip (contains "AS Alexela Terminal.exe")

GuLoader payload URL:
https://copiadoras-delcentro.com/a1/bin_jaEfB9.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 07:36:11 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
21 of 48 (43.75%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 33773ec8398380a43403e2670bbf33406d9e050f4f6605f3168e4a09a8fbe8f0

(this sample)

GuLoader

Executable exe 31bbcec93f8b67bf3f88604f02be4ab02ef1b6b55829d864381db26848ee8773

  
URLhaus
https://urlhaus.abuse.ch/url/368651/
  
Dropping
MD5 3f5bdc76cf1784298f0e3cab49477f38
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 31bbcec93f8b67bf3f88604f02be4ab02ef1b6b55829d864381db26848ee8773

Comments