MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52c7c13d415b878581b28e0fb576e4397fd81d5b036ebe125521f4d1d94f04f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52c7c13d415b878581b28e0fb576e4397fd81d5b036ebe125521f4d1d94f04f3
SHA3-384 hash: b36d66d1a7aa36d48172c1bfb7f8a251c24e87145a61d232ff29f3deb7e2d4a77ab9fe1d4d1e54dba9d2dc32734623e0
SHA1 hash: fd6e28947266422a780f3eb76e13e4a83d3326f4
MD5 hash: d1e76273ccd8a7839fa4a2cdec869cda
humanhash: kilo-paris-cardinal-december
File name:Purchase Order.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:25'555 bytes
First seen:2020-05-12 15:44:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:0jfxM88hrlZu8G4NPm0cse7AIU+7q4flxGx:0Dt8hrlNG4e0orBty
TLSH EFB2E10B1C4F1B19ACAB090AAB74DEA14905DF4BAC587E91383701FD7D70DE422CD989
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: tevapharm.com
Sending IP: 37.49.230.207
From: Ricardo <tevair@tevapharm.com>
Reply-To: onemilliondo@gmail.com
Subject: New Purchase Order from Teva Pharmaceuticals, Ltd.
Attachment: Purchase Order.zip (contains "Purchase Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.20845.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 10:43:03 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kld4cpkblodylansryh3k5xehf75qhk3anxl4esveh2ndwkpatzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 52c7c13d415b878581b28e0fb576e4397fd81d5b036ebe125521f4d1d94f04f3

(this sample)

GuLoader

Executable exe 720004239ef0cb716b2f0d8793cfe7fb06d408cd5c598a6c726aab7f21c0bad0

  
Dropping
MD5 754e8802e57da987ca7c137b0736727b
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 720004239ef0cb716b2f0d8793cfe7fb06d408cd5c598a6c726aab7f21c0bad0

Comments