MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50d487621decc715e2b3e349679aba07ecb93d3ee55a3605ec0606d11a05dcd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 50d487621decc715e2b3e349679aba07ecb93d3ee55a3605ec0606d11a05dcd2
SHA3-384 hash: ed2d8e65cbfbec1e77d78aa83e158fc31c834e730103cc6b68f5c87f6c479a58859941f185fe981e5138d1a47df0d4e0
SHA1 hash: 05e186e4867b930aabeb50fd3fa8c41957696ead
MD5 hash: e765530feaf53ea90810cfef111c5d5a
humanhash: fanta-robin-ten-connecticut
File name:50d487621decc715e2b3e349679aba07ecb93d3ee55a3605ec0606d11a05dcd2
Download: download sample
Signature GuLoader
Create hunting rule
File size:267'181 bytes
First seen:2020-03-27 08:04:49 UTC
Last seen:Never
File type:Rich Text Format (RTF) rtf
MIME type:text/rtf
ssdeep 1536:m7STPxyjtHv9YH9x/6oI/akRKOWbUx9JE6mQgaeeVhMDw5wfL2:mql7aRDAw5wfa
Threatray 1'173 similar samples on MalwareBazaar
TLSH 5E4474F420CB4950E749A429E594F49D05B6BAE3B0C85DB817EFE8339E59FD01E8818F
Reporter Marco_Ramilli
Tags:GuLoader rtf

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Exploit-RTF-Dropper-1.UNOFFICIAL
Create hunting rule

MiscreantPunch.EvilRTF.CommonLure.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.RTFSTR.SCRIPTLET.200421.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Script-VBS.Trojan.CVE-2017-8570
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 10:45:04 UTC
File Type:
Document
Extracted files:
10
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1b2e0d5dd025f3af551020940f5cb7bfa79ce059f90cb62bafc0c8490f197bc7
GuLoader
6dcf4557563343e881daf4b7d7b01e372457cee637ac001a1102a2e67a69cbf8
GuLoader
a3314185c4c7b813105231aa59fbf2045b1fa595fd4bf322370112926afc24a7
GuLoader
bc7549c1281f3ce45abcaad7408522374c97421e9031998b7959bd5e59b27a93
GuLoader
c7c2e3e6dc40ec793635b6f18e44223d8cbf9fb621ee0d5b374b709510fe2d9a
GuLoader
d30f4ed99917a14353e7c981b527597931c9d7440e55173bb44dd6ac6317da95
GuLoader
d725785ec3970b75ecb17a7e5ac14d93ce7a54d259dffc74e8222ed8cfb8b6b3
GuLoader
e0d0b8ce88eb76ca3cb8339d7f49d2d198b2a51b43949b4ddd23a40889cafcc9
GuLoader
e265bbf3f727ff892423b3e24b5368ab4f694c86334bf68ae62ff20dfd7ce5b6
GuLoader
fb6a49d393c339750c2effe7797cf304d7d9bb8c95fdaa3431af177f7a677ba8
GuLoader
+ 1'163 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:win_alina_pos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_gootkit_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments