MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f4e249205586ef2ff2de22d6f151a016574e362255568d06e4d848e41623516. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f4e249205586ef2ff2de22d6f151a016574e362255568d06e4d848e41623516
SHA3-384 hash: e20d35053a7bb152d02eb5a2741eb5d900e28f2f405ef4f8704ef5ea35459a4f48c1ec551b344877457e52a35825fdf8
SHA1 hash: fc9da6b13dc7762dabce7bbd430335786c560d80
MD5 hash: 424365bb64240f3167429f9a98ce6430
humanhash: lamp-london-hamper-cold
File name:LNG_137507B.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-13 10:10:58 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:CDEGSH3j+Rb3jAnBjyRsdwC9ZymYsWDw2sBTYJujzCE0TW24D/Tkk8mNmmXyUhK:CGH3CRonBNdds33wLBrNw
TLSH 9D451A17F2A44576E6948A74DB3897E9136AFC24393149033ACC3B7C0F3B64566622BE
Reporter abuse_ch
Tags:geo GuLoader img KOR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: toi12.com
Sending IP: 173.82.154.37
From: 서진효 <daewon77@daum.net>
Reply-To: daewon77@daum.net
Subject: REMINDER [울산북항 LNG PKG]Request for Quotation_터미널 1단계 LNG Package 건\설공사
Attachment: LNG_137507B.img (contains "Pron.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.GenKryptik.EKMN.29746.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 10:36:41 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j5hcjeqflbxpf7zn4iww6fi2afsxjy3cevkwrudojwci4qlcgula._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 4f4e249205586ef2ff2de22d6f151a016574e362255568d06e4d848e41623516

(this sample)

GuLoader

Executable exe d7aef406cc623d210aa08b240098e0976b28d745685385b8aee5df41e78e5e4e

  
Dropping
MD5 21592933e5bf5dbaa0f6ee24ce1b0d00
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d7aef406cc623d210aa08b240098e0976b28d745685385b8aee5df41e78e5e4e

Comments