MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38f28ec047f6697180e13197c394304a83a58b76f6727f1352db0f7ea6312139. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38f28ec047f6697180e13197c394304a83a58b76f6727f1352db0f7ea6312139
SHA3-384 hash: e8de9d207cf9824968593006307cb0be4dc370203f89126033191ebe7734ad10aeab8d18176ede1f3b6c24f328a1b0af
SHA1 hash: b4e0c4b45f12185dacb9c46155d6b7e4924fb8b5
MD5 hash: 73bee56389b465891474787287a57edf
humanhash: crazy-vegan-diet-lemon
File name:New-Order IMS NO.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:110'592 bytes
First seen:2020-08-06 05:48:09 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:Sp1p1NqGkX5ttIqVZ24d5kiIBt1TIU6L7/MFdSpHwz6m8oAxSO:kh45jImfatef0yH/wO
TLSH C2B3E612A2F4F23DE16147F16F5446AB41FA7F320522B85BB68C2E9D4B32D5FA46031B
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: outgoing2.jnb.host-h.net
Sending IP: 129.232.250.56
From: IMS - Internasjona lmatsenter AS <posta@imsonline>
Reply-To: ahmetyavuz@baktat.com.tr
Subject: New order IMS NO // PO 001 - 06.08.2020
Attachment: New-Order IMS NO.img (contains "New-Order Gima.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/38f28ec047f6697180e13197c394304a83a58b76f6727f1352db0f7ea6312139/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 01:02:27 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hdzi5qch6zuxdahbggl4hfbqjkb2lc3w6zzh6e2s3mhx5jrree4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/38f28ec047f6697180e13197c394304a83a58b76f6727f1352db0f7ea6312139

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 38f28ec047f6697180e13197c394304a83a58b76f6727f1352db0f7ea6312139

(this sample)

GuLoader

Executable exe e05f05fb070ab182f3f8daadedde9b58ba9ab1c9bf0dd66bd2e8a5a9ac63f479

  
Dropping
MD5 a8f7b0bcfae637df74f3721f2f668d34
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e05f05fb070ab182f3f8daadedde9b58ba9ab1c9bf0dd66bd2e8a5a9ac63f479

Comments