MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ff56dd9c45c74e0dc4e367c07ececf825c4d966cdd59c221edbd8dbbf84907b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ff56dd9c45c74e0dc4e367c07ececf825c4d966cdd59c221edbd8dbbf84907b
SHA3-384 hash: a9bf4d223a518cceab05e021aa6e35a5813f590b8efef2daa0c9da6919bf02efaa4fc67948329da7095b1d0aa7cc2a4e
SHA1 hash: abb21a3ab86622045e300f55657a297d3197064e
MD5 hash: 9f57ad7823380f851a0b972fd349f0ec
humanhash: king-coffee-wisconsin-black
File name:P.O 465 Arrow chemicals_PDF.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:24'793 bytes
First seen:2020-05-14 04:30:51 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 768:jn9kU4bSs7EMUoAlhXAR/tx64+BmYPkpJJYwtNT2Ye:zav7erXAR/n64+TP9qyYe
TLSH 70B2F104F01CA778D5E26729FA68720DDF298D9708207E75EF9ED1C148B596B6BC014A
Reporter cocaman
Tags:GuLoader gz


Avatar
cocaman
Malicious email
From: G. Karpagam <azq@pixelnx.com>
Received: from in.pixelnx.com (in.pixelnx.com [103.90.242.177])
Date: 14 May 2020 03:17:11 +0000
Subject: New Proforma Invoice - Urgent
Attachment: P.O 465 Arrow chemicals_PDF.gz

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.PonyStealer.fm0@oqz1Z2nG.23266.11633.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 04:35:31 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h72w3woelr2obxcogz6ap3hm7as4jwlgzxkzyiq63pmnxp4esb5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 3ff56dd9c45c74e0dc4e367c07ececf825c4d966cdd59c221edbd8dbbf84907b

(this sample)

GuLoader

Executable exe 20b3c1c5495ed7389cb63dfe6f990c7acd72edd8a6e385cbe698702647d44649

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 20b3c1c5495ed7389cb63dfe6f990c7acd72edd8a6e385cbe698702647d44649

Comments