MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e3eed34661ffc1a326fcd04cdb51829236a2ef90ba97603393cb83c39d14a13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e3eed34661ffc1a326fcd04cdb51829236a2ef90ba97603393cb83c39d14a13
SHA3-384 hash: 922ba40a8eeb9982e8705b5a43106161f320e90d675dbb82cd786454f4fd056c8c027ceebcef6162cc697fada10247c6
SHA1 hash: 7f61aebea2754f96a0263c9c1a569e6b319a7315
MD5 hash: 564745371d85e64a24fbb531e935dfc2
humanhash: fish-texas-floor-december
File name:chevron.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:54'448 bytes
First seen:2020-05-28 13:17:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:JnL0Z6W4HthEesA0lh5VJmt19N8w/rEKAOzX0:bXZsblLHmtXWyrE+zk
TLSH 1333F1F104A7F777C33C195ACCE917B2616B267AA6FAC97026C56A54504BCC671018FC
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: ns1.mostplace.com
Sending IP: 203.146.102.40
From: Najam MS-chevron Malaysia <Muhamrnad@chevron.com>
Reply-To: chevron Malaysia <Chevron.malaysia@asia.com>
Subject: Quote Requests))
Attachment: chevron.zip (contains "chevron.exe")

GuLoader payload URL:
http://mexiwoodstudios.com/a1/bindonmaster_pnljydbm231.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis8EC5098126D1.29198.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 13:37:39 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 3e3eed34661ffc1a326fcd04cdb51829236a2ef90ba97603393cb83c39d14a13

(this sample)

GuLoader

Executable exe 4e16c663be416ebc214f67367811ccbfec46102cc9ecac856b91f58ff775885d

  
URLhaus
https://urlhaus.abuse.ch/url/370979/
  
Dropping
MD5 8ec5098126d15d9e6d03a47c82595b02
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4e16c663be416ebc214f67367811ccbfec46102cc9ecac856b91f58ff775885d

Comments