MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5654a745ac155f705c8a41216bbfeff470514f9cfe2c063024caeeddc3cde913. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 7 Yara Comments

SHA256 hash: 5654a745ac155f705c8a41216bbfeff470514f9cfe2c063024caeeddc3cde913
SHA1 hash: 6b876bffff5013ca737b29d7633d31ed7fe36c72
MD5 hash: 7fc1c06da2c2a4a44028e95ac0b4b098
File name:Billing_Statement-162315070.rar
Download: download sample
Signature GuLoader
File size:51'507 bytes
First seen:2020-05-22 09:49:09 UTC
Last seen:2020-05-22 09:49:55 UTC
File type: rar
MIME type:application/x-rar
ssdeep 1536:PaGO1wXQegaMjjXwQvLdfqbyvLXSjLncC4G:SGCCQegPnnvLB1XSjQC4G
TLSH EA33F2E7079DDD51D3B1D40F589B7ADA0AB9A7C51FF89303AE8DD7380918AD20C49287
Reporter @abuse_ch
Tags:GuLoader rar

Malspam distributing GuLoader:

Sending IP:
From: Total Credit Management Services Ltd. <>
Subject: Billing_Statement-162315070; 162315090
Attachment: Billing_Statement-162315070.rar (contains "Billing_Statement-162315070.xlsx.exe")

GuLoader payload URL:


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 19
Origin country US US
ClamAV Sanesecurity.Malware.27214.RarHeur.nocdb.UNOFFICIAL
VirusTotal:Virustotal results 33.33%

File information

The table below shows additional information about this malware sample such as delivery method and external references.



rar 5654a745ac155f705c8a41216bbfeff470514f9cfe2c063024caeeddc3cde913

(this sample)

Delivery method
Distributed via e-mail attachment