MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3602be64b69c30e4201700f2c25c7f852344796d7176bf990a40e667c245660a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3602be64b69c30e4201700f2c25c7f852344796d7176bf990a40e667c245660a
SHA3-384 hash: 6bfa62d06cc27882ddb5a739801e59c6e8ee9719aa79a97adf53631ac563b23900643850d02c59f9b0a1f752faa33189
SHA1 hash: 4d4c064804498fda668dce6484148838ed7347f4
MD5 hash: 77ca9456b69c61304f50b78fad8dd55f
humanhash: bacon-october-gee-cardinal
File name:PO079375.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:41'565 bytes
First seen:2020-06-09 06:36:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:ZqFMAVfUe9Bl2ObWY7g2poX48C+sidZZ5hZ8KdGKKJ/zCfmWpo:krJ2sW6oX495o5H8K0KKJ/zChpo
TLSH DB13E1E2549ACD34EFAAF3B130EE3CA0CE94145BC24CFA0F33B49D09DE595649019769
Reporter abuse_ch
Tags:GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: coreit.mynewserver.com
Sending IP: 88.99.38.211
From: Sarah Wong <kelly.giotopoulou@theluxuryspot.gr>
Reply-To: Sarah Wong <tolentinomavi13@yahoo.com>
Subject: Request for Quotation
Attachment: PO079375.gz (contains "PO079375.exe")

GuLoader payload URL:
https://octagongrinning.site/bin_PsvLtX71.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 01:45:29 UTC
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gybl4zfwtqyoiiaxadzmexd7qurui6lnof3l7gikidtgpqsfmyfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 3602be64b69c30e4201700f2c25c7f852344796d7176bf990a40e667c245660a

(this sample)

GuLoader

Executable exe 3e1b8febf5f7c0c794dad1a6ae195de982e8c0940997568a370c6fb21511d98a

  
URLhaus
https://urlhaus.abuse.ch/url/384279/
  
Dropping
MD5 960b8961f9af4622676042691b5bc3c2
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3e1b8febf5f7c0c794dad1a6ae195de982e8c0940997568a370c6fb21511d98a

Comments