MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47e7740529843e49fe3e29d8dffd7c2aea254d848beeda3004de6b3465aeaad1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47e7740529843e49fe3e29d8dffd7c2aea254d848beeda3004de6b3465aeaad1
SHA3-384 hash: 63e1bfc2c4815f3bf7ae1a400a8dc6377979b0135a1fe4a80972345ecfb4d53b701715cca3032ce6cf103e31e7a68400
SHA1 hash: df4c1e4aa18700d3d5325255287439f8203c815c
MD5 hash: efc85f3bff2c7c25bd1e6ad2cb329ded
humanhash: asparagus-finch-michigan-double
File name:Remittance_advice.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:31'181 bytes
First seen:2020-05-27 17:13:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:1BH7IYgCmLNUPcskG1M4mn5XmATFEf4hi16AdA+uTRlY:1BbIYgCGNUEPG1M05fAiq3Y
TLSH FBE2E1BF4BC496A0D8A77A1325D0BCA6353F0137CC640166A0FF6B53DC0E4D59A9CA6E
Reporter abuse_ch
Tags:arj GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail.neoit.es
Sending IP: 178.33.164.95
From: PAYABLES-MOTION <s.chen@motiontp.com.tw>
Subject: PAYMENT RETURNED DUE TO INVALID ACCOUNT
Attachment: Remittance_advice.arj (contains "remittance_advice.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1c5lzohFTcu6YxSNW_ceYOkqgZKVl1rW4

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.50089.32178.15075.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 13:55:20 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 47e7740529843e49fe3e29d8dffd7c2aea254d848beeda3004de6b3465aeaad1

(this sample)

GuLoader

Executable exe 9e2ed2731c8644b4117f5ca507b20cdc8a1e38f0e1d20a6b7a98580552599f76

  
URLhaus
https://urlhaus.abuse.ch/url/369927/
  
Dropping
MD5 ee476ba12ffc46e3827cb55147b3e6a7
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9e2ed2731c8644b4117f5ca507b20cdc8a1e38f0e1d20a6b7a98580552599f76

Comments