MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47a198a1aff99ac7951b680937cea913822d1aed72360568639f34f8efd133d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47a198a1aff99ac7951b680937cea913822d1aed72360568639f34f8efd133d5
SHA3-384 hash: 481b85b20a4d7f927b83838aaa40ee0f5aac116c1c2f4fbe7e1e1d2485f850bd3d0e08857f8d3e911fdb7ca5aca59515
SHA1 hash: 705a733c10f731768a20c8cb0d6f0f2c351fa1c0
MD5 hash: 712b4c8d5795f571f14d7705fcaf211b
humanhash: steak-paris-kilo-uranus
File name:Rev-PO-068789MT100_65657_Sample-Order-.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-28 07:33:13 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:2sx+XA/5MrVchr8AZRBhP2e2968IUEUVctdDqAnB7CQPgiLqy9xdl39pER3ubIr5:WQGrCRxFFR299ZEA+BpK3Tn
TLSH 76453A2AB266DCB1DA8449B0DCD0D5F01861BC10E9178A6B32DC7F2F337A087DE66635
Reporter abuse_ch
Tags:geo GuLoader img KOR


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm80.hanmail.net
Sending IP: 211.231.106.155
From: 주식회사 아토즈서플라이서비스 <1231113kes@hanmail.net>
Subject: 견적 긴급 요청
Attachment: Rev-PO-068789MT100_65657_Sample-Order-.img (contains "Order.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1YqSVfiPRiAtYRqCZxJmAuXrFwe15wmRt

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.50242.9072.18749.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 07:37:34 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 47a198a1aff99ac7951b680937cea913822d1aed72360568639f34f8efd133d5

(this sample)

GuLoader

Executable exe 742fa567f6c1b57e2d73442cd06817027e09ac33b4cbdbafef0cd462e9bf6343

  
URLhaus
https://urlhaus.abuse.ch/url/370291/
  
Dropping
MD5 cec6b5bfaf84582c75bce0c83a3de2d3
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 742fa567f6c1b57e2d73442cd06817027e09ac33b4cbdbafef0cd462e9bf6343

Comments