MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52a9a53ffae45970bebb8073dbedce1f568255512a15cd0fff9859a704d0fd5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52a9a53ffae45970bebb8073dbedce1f568255512a15cd0fff9859a704d0fd5b
SHA3-384 hash: 2b5529b5b15791f61572d07df38305002d187fcb73f620f0cd2c7d588bdd7e33ffa328466535b6eb71497cbac4e6d275
SHA1 hash: c61f49397e722b4802c3ab28f852849cc2b3215f
MD5 hash: 245ac4d2bb80f4bb6ce6db2fdee0219c
humanhash: green-bakerloo-crazy-venus
File name:NOA_COSU7221931450.PDF.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:24'789 bytes
First seen:2020-05-13 10:22:57 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 384:tRW/yWUjLI2PchPioVSS8Se9e3w3e24lDh5YCYkQJYhr9SL7pEGwg8Kb2lzVfJ2O:tBL6P0Se9e3wudlV5Y/Gh5SL778lpfJr
TLSH E7B2E0F33F745B7E860B8518CC2093078D57BDE954D4CAB088C1F016FC7BAE4549599A
Reporter abuse_ch
Tags:GuLoader gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: dci82.dotcomindonesia.com
Sending IP: 50.23.82.235
From: COSCON_Provided Documents_JAKARTA <jakarta@taipan.co.id>
Subject: -Proforma Bill of Lading for NOA//PT. KUKAR MANDIRISHIPYARD//COSU7221931450
Attachment: NOA_COSU7221931450.PDF.gz (contains "NOA_COSU7221931450.PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Heur.VP2.fm0@a4IwXSoi.7714.30924.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 10:36:43 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kku2kp724rmxbpv3qbz5x3ood5lievkrfik42d77tbm2obgq7vnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 52a9a53ffae45970bebb8073dbedce1f568255512a15cd0fff9859a704d0fd5b

(this sample)

GuLoader

Executable exe 4f4ffd4acbf022b50208d546731446d3c5b16380a244dab0261ad0cad8ce02e0

  
Dropping
MD5 03c335dba450e43e644c29eaf4383f3e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4f4ffd4acbf022b50208d546731446d3c5b16380a244dab0261ad0cad8ce02e0

Comments