MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c75f6733f6e63f6e5dee0054bba79fe75c935d31c247e6d98b2b7e85eb9c729. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c75f6733f6e63f6e5dee0054bba79fe75c935d31c247e6d98b2b7e85eb9c729
SHA3-384 hash: 798831017f27e55e90874f2e6377d2d51b917fb828a2b50d88bd2bcb398693fa3a0380cf63f25942d86885bb9c972b19
SHA1 hash: 36916286899a69abb4478effbfe62062df394d41
MD5 hash: 3cd2e80be3eda94c528a7b0a892559fc
humanhash: arizona-oscar-kilo-london
File name:Purchase Order 02374.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:41'249 bytes
First seen:2020-06-09 06:42:48 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:Hpn2DG6N34C2eewrnyKwv6HNmdjNHV26iyuqSKRXD1IpZNcAHNSif1k:J2DG6N3NHyKwvrN8Mu2z1IpZNPa
TLSH 3103F1EECCF5D2859532D69D98D307FAA168CFED806618A484B83B341C598F98648F0D
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server.vimsmail.com
Sending IP: 198.57.186.8
From: Angela <angela@texwelldone.com>
Reply-To: angela@texwelldone.com
Subject: Fwd: REQUEST FOR QUOTATION
Attachment: Purchase Order 02374.zip (contains "Purchase Order #02374.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1bG8yc_o-AM-F8_LsZPB79N1mq3YilFxt

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 06:44:09 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hr27m4z7nzr7nzo64acuxotz7z24snotdqsh43mywk36qxvzy4uq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 3c75f6733f6e63f6e5dee0054bba79fe75c935d31c247e6d98b2b7e85eb9c729

(this sample)

GuLoader

Executable exe 8d73f17a44953ad8b611e21a6b661c0f39255a88f1a567640110ed8a364ee2ee

  
URLhaus
https://urlhaus.abuse.ch/url/384280/
  
Dropping
MD5 98675f9dec2608336b58a1588ee47452
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8d73f17a44953ad8b611e21a6b661c0f39255a88f1a567640110ed8a364ee2ee

Comments