MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5654a745ac155f705c8a41216bbfeff470514f9cfe2c063024caeeddc3cde913. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 7 Yara Comments

SHA256 hash: 5654a745ac155f705c8a41216bbfeff470514f9cfe2c063024caeeddc3cde913
SHA1 hash: 6b876bffff5013ca737b29d7633d31ed7fe36c72
MD5 hash: 7fc1c06da2c2a4a44028e95ac0b4b098
File name:Billing_Statement-162315070.rar
Download: download sample
Signature GuLoader
File size:51'507 bytes
First seen:2020-05-22 09:49:09 UTC
Last seen:2020-05-22 09:49:55 UTC
File type: rar
MIME type:application/x-rar
ssdeep 1536:PaGO1wXQegaMjjXwQvLdfqbyvLXSjLncC4G:SGCCQegPnnvLB1XSjQC4G
TLSH EA33F2E7079DDD51D3B1D40F589B7ADA0AB9A7C51FF89303AE8DD7380918AD20C49287
Reporter @abuse_ch
Tags:GuLoader rar


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: mxserver22-out4.masterweb.com
Sending IP: 103.25.223.204
From: Total Credit Management Services Ltd. <inquiry@totalcredit.hk>
Subject: Billing_Statement-162315070; 162315090
Attachment: Billing_Statement-162315070.rar (contains "Billing_Statement-162315070.xlsx.exe")

GuLoader payload URL:
https://qif.ac.ke/komi_yUyfmoyRdV90.bin

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 19
Origin country US US
ClamAV Sanesecurity.Malware.27214.RarHeur.nocdb.UNOFFICIAL
SecuriteInfo.com.Suspected-exe-in-RAR.UNOFFICIAL
VirusTotal:Virustotal results 33.33%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 5654a745ac155f705c8a41216bbfeff470514f9cfe2c063024caeeddc3cde913

(this sample)

  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment

Comments