MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ffcfce8f63363be09d081e5ae11670e7cf89e73bad9df96c4690e6945e5bfba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ffcfce8f63363be09d081e5ae11670e7cf89e73bad9df96c4690e6945e5bfba
SHA3-384 hash: d39cb9352f5e1012835f108f4a9aae1e711a8258819557c445ea386626a079d13f797afdaa1d300d12a3f46fc20d2941
SHA1 hash: 340dd9773a4e4c4b578ce3b2a69fd1725994ca12
MD5 hash: 87baa11625e558dce94fe4c7bd987ac5
humanhash: south-johnny-fifteen-kansas
File name:vaccine release for Corona-virusCOVID-19_pdf.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:25'917 bytes
First seen:2020-04-02 15:46:15 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:Df5ihlWjBGRZTCFhlp2MPpuivZe3XlIOKiPYC9ckk:DQ0BQTCFh2MPpuT312iPYC9cp
TLSH FBC2F1E950D8D64AAC38CBF2AFA512287B0D10D2786C73D42DD694120E7DFF278895B4
Reporter abuse_ch
Tags:COVID-19 GuLoader rar


Avatar
abuse_ch
COVID-19 themed malspam distributing GuLoader:

HELO: ns392991.ip-176-31-110.eu
Sending IP: 176.31.110.7
From: Dr. Kim Jung <info@hardworkingincs.pro>
Subject: Latest vaccine release for Corona-virus(COVID-19)
Attachment: vaccine release for Corona-virusCOVID-19_pdf.rar (contains "vaccine release for Corona-virus(COVID-19)_pdf.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1bFy5HnzXjqp_6iwYqe0llnfhnqmeXAiR

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h76pz2hwgnr34coqqhs24elhbz6prhttxlm57fwenehgsrpfx65a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 3ffcfce8f63363be09d081e5ae11670e7cf89e73bad9df96c4690e6945e5bfba

(this sample)

GuLoader

Executable exe 8c1b12be1067ff4a545a6f94c820cad44ec7c13250003f76c4e601d61be5c56a

  
URLhaus
https://urlhaus.abuse.ch/url/334045/
  
Dropping
MD5 210f433a5bd1dce3270da1491e35e45b
  
Dropping
SHA256 8c1b12be1067ff4a545a6f94c820cad44ec7c13250003f76c4e601d61be5c56a
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8c1b12be1067ff4a545a6f94c820cad44ec7c13250003f76c4e601d61be5c56a

Comments