MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44a3b70c39cf0b38edd6bced90fe8bd6c2eec0800d79a1054994217ab500a062. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44a3b70c39cf0b38edd6bced90fe8bd6c2eec0800d79a1054994217ab500a062
SHA3-384 hash: 3869c1170617820af0ba6de43918adc84b3ef9e4acae33fb5cf24a6532b257eb3f5e3dbf93ed51fa406a973a11c2ffe9
SHA1 hash: 05880922d87416c12105a5bb418ce7a3cdb09498
MD5 hash: d91783c1c8f5e4eb80ee2a4f53a9d4a6
humanhash: network-happy-romeo-washington
File name:Product List.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-13 10:31:33 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:JVb5B+bykQQEnbGWMSj/znb+J+L+Dg/ZSBDEm6BabvV2h0kjAhS45eTlSdY9rV56:J5H0EnbG7SHqJ+L+Dg/MBgOgjZrre
TLSH 42451B52B2905063D3548A71EB38D799D2AAFE31362249473ACC375D5F3BA417A3233A
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.vstmotors.com
Sending IP: 59.160.116.104
From: r.anbarasu@vstgrandeur.com
Subject: Product order list enquiry
Attachment: Product List.IMG (contains "IMG SCAN INV DOC#13T331.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Generic-7788440-0
Create hunting rule

Win.Trojan.Generic-7789322-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 10:36:38 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
16 of 30 (53.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=isr3odbzz4ftr3owxtwzb7ul23bo5qeabv42cbkjsqqxvniaubra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 44a3b70c39cf0b38edd6bced90fe8bd6c2eec0800d79a1054994217ab500a062

(this sample)

GuLoader

Executable exe 6f05a4c741ce687b728cad820f1bf2667037ae77a51760a559765195115d0ab9

  
Dropping
MD5 b5654558265caf1e64b86ea27a3d3750
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6f05a4c741ce687b728cad820f1bf2667037ae77a51760a559765195115d0ab9

Comments