MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39d856875880e8470714858bb8c94f821a43a709e472578a06f374069d578d82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 39d856875880e8470714858bb8c94f821a43a709e472578a06f374069d578d82
SHA3-384 hash: 04d18d896a8b493e3dfab90c8b8447b07e1cf682ae303dde5b705ea882473854344007ef03d0bc46aa664f43b7766b5d
SHA1 hash: 1264fcb1612db89a9d8febd8f5168b6b9a69dea7
MD5 hash: 26181bb8ab8819c519148b88cc5de845
humanhash: five-october-romeo-fanta
File name:BPN___023928390511026.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:25'094 bytes
First seen:2020-05-12 15:54:35 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 384:sX3fvzv2sHRWbtBVxqgBimnB5Lvsdzt7ptC7CNXVsoB7EhddFU3xEI0q3v4G3yJu:sHfbJqf0QPvsz7TskXVB7Iy3iq3vxRp7
TLSH 5FB2E1992C276DBABBD883CE5F1D43039CE32481A35359240D12C5ABD86E67C52D2C27
Reporter abuse_ch
Tags:GuLoader gz TNT


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: s01.id-svr.net
Sending IP: 103.52.144.60
From: TNT Cargo || Jakarta Branch <jplawfirm@jurnalisponto.co.id>
Subject: CONSIGNMENT NOTICE// NGBKHI20010274 2X20GP//TNT#KTW 886114/2020
Attachment: BPN___023928390511026.gz (contains "gunzipped")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Fareit-7784794-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 03:13:00 UTC
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hhmfnb2yqdueobyuqwf3rskpqinehjyj4rzfpcqg6n2anhkxrwba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 39d856875880e8470714858bb8c94f821a43a709e472578a06f374069d578d82

(this sample)

GuLoader

Executable exe 2679b68e7d2bc1eff0bb4969fc23081d38f08b72510107adcb18a2ffaa9ffca8

  
Dropping
MD5 d6037b635c45d8c93f899af6864c87df
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2679b68e7d2bc1eff0bb4969fc23081d38f08b72510107adcb18a2ffaa9ffca8

Comments