MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49989d5d8d212f55751bd8668f3bf17782a96e415526d9bb51a5917f66a469c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49989d5d8d212f55751bd8668f3bf17782a96e415526d9bb51a5917f66a469c3
SHA3-384 hash: b5d9dd857f27efa52d9d5b64e36e816108b84d0fb3012abf05ed4420d7891f4a6bb6e76d560db99e56181dcde19df06e
SHA1 hash: e6ad8809f5ae4ee72c113f483d7a2f40d304f7a8
MD5 hash: 12f450563271da9ca131142975ecd6bb
humanhash: sink-twelve-beryllium-king
File name:Fresh Order_Company INFO.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:53'770 bytes
First seen:2020-05-28 07:35:27 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:5DjMHSx4oDL8laWWaaKvQgZ+sTf7ic58st93QskwjRG9oHbwmXSzh4sfx+tM9z1B:14HK5+aZ2ZPTfOc7dNXXIxt91B
TLSH 1533017CA8BA47475F0F27684A6B27AAC85B5C0F3CD5F808617942D804E66C1B49CFEC
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: smtp.formosabag.co.id
Sending IP: 122.102.44.2
From: pbjl2@formosabag.co.id
Subject: Fresh Order Requisition
Attachment: Fresh Order_Company INFO.rar (contains "Fresh Order_Company INFO.exe")

GuLoader payload URL:
http://ratamodu.ga/~zadmin/iclient/frega_gFsdIGK252.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 08:34:09 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 49989d5d8d212f55751bd8668f3bf17782a96e415526d9bb51a5917f66a469c3

(this sample)

GuLoader

Executable exe ceb781fef96cb41bc001482e6cd3af83da86eaf8dad6c06a4d07a4e364e7b548

  
URLhaus
https://urlhaus.abuse.ch/url/365940/
  
Dropping
MD5 dbd8b1ab4644e44b83f2d6d434617a95
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ceb781fef96cb41bc001482e6cd3af83da86eaf8dad6c06a4d07a4e364e7b548

Comments