MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45e3c54aac3961c6f79fe29c1d81b6e57e51aa9b479fdd070fa1e671c5251d85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45e3c54aac3961c6f79fe29c1d81b6e57e51aa9b479fdd070fa1e671c5251d85
SHA3-384 hash: 4a280257a7bd1ad9d530228d1896ff8dfcc7bbb289797f8684f0ba43c096cdc45cc6595176e35be432e3609995831f1d
SHA1 hash: 3745c7a4fe647353825c39a641adf52f03a132c2
MD5 hash: 31d0e31ac28b40ada01011092043e8e8
humanhash: bulldog-tango-burger-failed
File name:Shoprite Order 1852293.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:23'237 bytes
First seen:2020-05-12 16:07:26 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 384:iGU10zKTB6C5J6CcRU6Rsd8St9XAxLL+Hdvhz4XRDRHwullqTzjO5WXoBXVCmgtk:iGUhgDu6Rsd8S3eLS5h8RDRHdqXQXV0k
TLSH BAA2E0790CC92C43FC28E144551FB2C7D0BC5CA9424B0B4ED2F20A3AAE073E9596EB26
Reporter abuse_ch
Tags:GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: host.sarmcol.com
Sending IP: 199.217.117.157
From: Sanjeev Raghubir <sanjeev@shoprite.co.za>
Reply-To: robles@ammeraalbeltechusa.info
Subject: Shoprite Order 1852293
Attachment: Shoprite Order 1852293.gz (contains "gunzipped")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.45878.4514.23431.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 02:21:00 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ixr4ksvmhfq4n5474kob3anw4v7fdku3i6p52bypuhthdrjfdwcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 45e3c54aac3961c6f79fe29c1d81b6e57e51aa9b479fdd070fa1e671c5251d85

(this sample)

GuLoader

Executable exe 6d774b6ef4a21efee8a9116bfc18ab1a0a0609e058638a77566a29c9d98f7982

  
Dropping
MD5 21b43b8b954b3bbc3634e50c1234da43
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6d774b6ef4a21efee8a9116bfc18ab1a0a0609e058638a77566a29c9d98f7982

Comments