MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38d3ac2f0ca1e37cbcd4b9fecf8a4396d29a4f183fe848042d1287e12bf23bf0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38d3ac2f0ca1e37cbcd4b9fecf8a4396d29a4f183fe848042d1287e12bf23bf0
SHA3-384 hash: bf21c49e9336d0d3c7c184bba0152bd9d03d7098b6b7153d4c2188e68249a36d1d01721db13f297fe907e8c06c93a0f0
SHA1 hash: 1c9f455aff180e7133fe5f164d37f52e3929dcbd
MD5 hash: 2efabc4257442e4fb53a17eac44dbe02
humanhash: harry-salami-mars-football
File name:Payment Slip Draft.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:32'503 bytes
First seen:2020-05-22 10:19:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:7hG5UhwOals8axFVHNATNbi6yPQ3haUTKQJhCwmyp:7hG5ua8tkKoRb97CTyp
TLSH 6FE2F161CC6BCE46FBB9501481523CCE844C7D34CBA9E61D3EBCF1A4961C459AACA5DC
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mx.shi-ig.com
Sending IP: 217.61.123.234
From: Account Department <jeff@shi-ig.com>
Subject: Re:SWIFT CONFIRMATION DETAILS payment commitment
Attachment: Payment Slip Draft.zip (contains "Payment Slip Draft.bat")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1d8617kLZCNQGn2EFatz6wpYYeqeclOOG

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Dynamer
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 04:17:20 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 38d3ac2f0ca1e37cbcd4b9fecf8a4396d29a4f183fe848042d1287e12bf23bf0

(this sample)

GuLoader

Executable exe 5014b473901c1517c80fa4229172b855af67b2f20f2e7e61bee8d21a9bb94478

  
URLhaus
https://urlhaus.abuse.ch/url/366520/
  
Dropping
MD5 9349b201422e4379371e654df66f36d9
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5014b473901c1517c80fa4229172b855af67b2f20f2e7e61bee8d21a9bb94478

Comments