MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46668542b411188a63bed9f565cc37793ad443d3198b21d7ef00cf2248945d01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46668542b411188a63bed9f565cc37793ad443d3198b21d7ef00cf2248945d01
SHA3-384 hash: 0b634aea7093af298d894a8b1843a537a28b7c9debd003ca7ba1c1e6e2706952855d4e33248b4c18406f6099520f4936
SHA1 hash: 085099e1211e22a97bf283e34c9983b51c160d92
MD5 hash: ae700742626a2ce9384cd26456fe4ee5
humanhash: spaghetti-black-bravo-mango
File name:XPE-S0007-LT-002_SPARE PART LIIST.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-26 07:53:10 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:XpBO7b0kWQK1P1pFs0/hxIc+VoFX9in8H6f+5u8JnAbD:XpBO7bNWQeNw0/sc+i55tAX
TLSH 364509237A950C52ECA98FF14CA3A67769237C2079148F17364DFB1D2B761C22F6172A
Reporter abuse_ch
Tags:geo GuLoader img KOR


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm47.hanmail.net
Sending IP: 203.133.180.235
From: 이태수 대리 <poskyung7878@hanmail.net>
Subject: FW: [XPLE PJ] Project RFQ/ Spare parts list [예산견적]
Attachment: XPE-S0007-LT-002_SPARE PART LIIST.IMG (contains "XPE-S0007-LT-002_SPARE PART LIIST.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1FaIrcjvh13I-GykLsBIbuVk9NXRIJfyH

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Agent.ERLN.15143.11595.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 08:36:51 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 46668542b411188a63bed9f565cc37793ad443d3198b21d7ef00cf2248945d01

(this sample)

GuLoader

Executable exe 1d4bd4bcfe5f31f317eabc6780b91c1499f4dfc22025cfa6eeec3bc188207dc3

  
URLhaus
https://urlhaus.abuse.ch/url/367850/
  
Dropping
MD5 7b954ae2e78326e015448134a21ea6c9
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1d4bd4bcfe5f31f317eabc6780b91c1499f4dfc22025cfa6eeec3bc188207dc3

Comments