MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 481b39b602838d89b0cc2f7faae06647a97a30593c2e7780879461954a59cf8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 481b39b602838d89b0cc2f7faae06647a97a30593c2e7780879461954a59cf8b
SHA3-384 hash: debf1cd1f8f1834bcd47aad2f7b7a6f0cb5e886ba72c70b7a8f3a812edc056838a94db93c81bca71ae3d2e754f1000b4
SHA1 hash: 16f24a10be24e0bcc2058a22ee042d96dbdd3958
MD5 hash: c8dbd74ad8ed3d08fcd38052e9f4c67e
humanhash: happy-five-hotel-pizza
File name:Doc.kr.xz
Download: download sample
Signature GuLoader
Create hunting rule
File size:21'539 bytes
First seen:2020-05-13 10:13:01 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 384:5TEml25XY6oISYKm7iMbN7a5Y9YnsR+n/v8hZn5xagzBHSP0XfaGOhylAFTjpLar:J/0hY6H2JMbN7a5Y9z4/Mn79yPO65Lar
TLSH 5CA2E06FF92D239722114C2B7A1278A430CCB0D9A6EA1B3FD8A0ED61C6C5F1B551B56C
Reporter abuse_ch
Tags:DHL GuLoader xz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: [134.209.156.135]
Sending IP: 134.209.156.135
From: DHL Customer Support <support@dhl.com>
Reply-To: kens87914@gmail.com
Subject: DHL Shipment Notification
Attachment: Doc.kr.xz (contains "Doc.kr.com")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 03:04:52 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
14 of 31 (45.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=janttnqcqogytmgmf572vydgi6uxumczhqxhpaehsrqzksszz6fq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

xz 481b39b602838d89b0cc2f7faae06647a97a30593c2e7780879461954a59cf8b

(this sample)

GuLoader

Executable exe 7cf754ed7c5a766f7622660204ef84baefe244fea900ee17fd5c80610fe302e9

  
Dropping
MD5 ec0609eca14b271cb6b11da6360a179f
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7cf754ed7c5a766f7622660204ef84baefe244fea900ee17fd5c80610fe302e9

Comments