MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49b9a91d5f36d09a7e35057467c97ea3655d011e9cfd71f7e64879f2a56a35ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49b9a91d5f36d09a7e35057467c97ea3655d011e9cfd71f7e64879f2a56a35ac
SHA3-384 hash: 4667eb687214a4879dccc16868acf0c6f92d5269377da6f2ec6c8fdd03014b9d07b78f1dfc42591e6b7f8cbfe35c4c34
SHA1 hash: f383d0f59b681a8a73dcae61553cd1ac96065775
MD5 hash: 5bc01ce199a37cebc53dc701292bd7e5
humanhash: island-floor-saturn-kitten
File name:302005210014 QTN.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-26 09:00:23 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:xFvjzFDgETzeAjzgIPblFk4ed58zLA8XwJpjitX8+jvdkBDUPMO4s+8r6roWfxE/:PFDgEHrwIPJF1edOL9KkbjW9UPMOJ
TLSH 9345E407768DADBEECB48FB0097189B50E76AC2138005B533D4DF72D1BB368D29A175A
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server.ecomotorhk.com
Sending IP: 162.144.56.225
From: Suchita M Sawant <Suchita.Sawant@sci.co.in>
Reply-To: Suchita.Sawant@sci.co.in
Subject: S551 ( VISHVA ANAND ) - QUOTATION AGAINST OUR ENQ NO.S551S211006 - COMPRESSOR (DONG HWA PNEUTEC)
Attachment: 302005210014 QTN.img (contains "order.exe")

GuLoader payload URL:
http://185.94.191.88/bin_qNQJqzF250.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Guloader-7900546-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 09:36:52 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 49b9a91d5f36d09a7e35057467c97ea3655d011e9cfd71f7e64879f2a56a35ac

(this sample)

GuLoader

Executable exe b228d75e595d01315f96909833ea8c7cb694dda499c54aaf3e261d2c7275cba5

  
URLhaus
https://urlhaus.abuse.ch/url/368753/
  
Dropping
MD5 4cc0d4bbdd13725fc4238e66171bf121
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b228d75e595d01315f96909833ea8c7cb694dda499c54aaf3e261d2c7275cba5

Comments