MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4937664a6f809558a30616914e13a552756b2789455fad77b245a752b5e8a35b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4937664a6f809558a30616914e13a552756b2789455fad77b245a752b5e8a35b
SHA3-384 hash: 227d616b66bf455d7d5943fe430147d7c9e34317daf82ccca3bbcda1021b1cf861bc488a0f00460758c8df0525fe9bd9
SHA1 hash: 4d200b4e382f77c9d28be8f2534ac79274d00c11
MD5 hash: ae8e036e620bb52b57597c02715467a3
humanhash: kentucky-mexico-kentucky-oregon
File name:RFQ SBO-700850-1172.PDF.r00
Download: download sample
Signature GuLoader
Create hunting rule
File size:284'260 bytes
First seen:2020-10-07 12:14:26 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:lbAEvLgUkF11H6Yr+PEAoiFHQz1h7pyZtmzA9lbvKIn/p6:RAEvWFz6Yr+ciHQzOd+Ip6
TLSH B45423A8C2E6274F68594CACD59E14C66E374D7393C3A31CDE14E7B0178EEAF16D8029
Reporter abuse_ch
Tags:Endurance GuLoader r00


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 162-241-204-248.unifiedlayer.com
Sending IP: 162.241.204.248
From: Supply1 TSL <supply1@tsl-me.com>
Subject: Enquiry
Attachment: RFQ SBO-700850-1172.PDF.r00 (contains "RFQ SBO-700850-1172.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4937664a6f809558a30616914e13a552756b2789455fad77b245a752b5e8a35b/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 11:12:18 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=je3wmstpqckvriygc2iu4e5fkj2wwj4jivp2255siwtvfnpiunnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4937664a6f809558a30616914e13a552756b2789455fad77b245a752b5e8a35b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

r00 4937664a6f809558a30616914e13a552756b2789455fad77b245a752b5e8a35b

(this sample)

GuLoader

Executable exe 99318ec61c4740a4cebe8c26bcd0c51f7d360773d49e13f0010d26f076afb8a1

  
Dropping
MD5 518b1d6bbcc8e6858a88908b2c02a51b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 99318ec61c4740a4cebe8c26bcd0c51f7d360773d49e13f0010d26f076afb8a1

Comments