MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38a3aac96a89ed3e3f5b3d8ea8bb3b95ba25d2d38a0d02a7324590b1485d81a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 5 Yara Comments

SHA256 hash: 38a3aac96a89ed3e3f5b3d8ea8bb3b95ba25d2d38a0d02a7324590b1485d81a5
SHA1 hash: a836744570a3f8d7dcf248e17d3ea55092f0958c
MD5 hash: 302a7400cd2dffe963934ff724fafeae
File name:order 52242020.arj
Download: download sample
Signature GuLoader
File size:24'039 bytes
First seen:2020-05-22 10:25:01 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 384:vrDEIO4iIACgKF3Y860Ez6heJ3FczWGtnkTs5PUHn4JN40PMDneFeviC:jDEqjpEBJnLgtUYf4GMDneFQ
TLSH 3AB2E1E0E1097D722868802F68BFE685BC6F2198BBC54D3885F1785625D9D283B73B84
Reporter @abuse_ch
Tags:arj GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: mail.euromaster.es
Sending IP: 82.223.70.126
From: Evangelos Fasilis <tdroggitou@deloudis.gr>
Subject: Re:New Order
Attachment: order 52242020.arj (contains "order 52242020.pdf.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1jMZLcuxisSMShYRaNdb03Q0Hh6mmbwio

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 22
Origin country FR FR
ClamAV No detection
VirusTotal:Virustotal results 14.75%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

arj 38a3aac96a89ed3e3f5b3d8ea8bb3b95ba25d2d38a0d02a7324590b1485d81a5

(this sample)

  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment

Comments