MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57e74fa3b91decf2b6ed81886669dd3ad0cd1ab89df9ef8bb67ad91d188eee73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 57e74fa3b91decf2b6ed81886669dd3ad0cd1ab89df9ef8bb67ad91d188eee73
SHA3-384 hash: 25076024b2b6b1912a8f17a25db80c1ce099ffb197fb619581907c06cb0c89456e0cccaac59711fcca58e6137d53c979
SHA1 hash: 5e5ce34b81b1603bd9c6551d23e0da19a493fd8f
MD5 hash: 2cfb8cdd5a3fb301410225ea1ceae8da
humanhash: undress-robert-salami-alaska
File name:New purchase order for nazir_06082020_pdf.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:47'454 bytes
First seen:2020-06-08 12:12:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:ksoXjvXXxTKDaD20AcwXKlXreYQHygaX7IufJTWGhMIugjQ/x1Qg79c:ks2jBwzcwXKleIXWGhMJgeZc
TLSH 8623025762BE1D878DDD3CF81A8F3AA2B92DCD71529FE1DB3126848016673C07BA581C
Reporter abuse_ch
Tags:arj GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: s1.smallhost.in
Sending IP: 103.46.239.70
From: Nazir & Sons Co. (Turkey) <rubab.s@nazirandsons.com>
Subject: NEW PURCHASE ORDER FOR NAZIR
Attachment: New purchase order for nazir_06082020_pdf.arj (contains "rover.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CLASSIC.32754.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 10:11:17 UTC
AV detection:
34 of 48 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k7tu7i5zdxwpfnxnqgegm2o5hlim2gvytx467c5wplmr2geo5zzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 57e74fa3b91decf2b6ed81886669dd3ad0cd1ab89df9ef8bb67ad91d188eee73

(this sample)

GuLoader

Executable exe 89e54f19c04bb28c90f0ee75419a149c8178f9841435a20be727506d0c9506d3

  
Dropping
MD5 22c374a9734bd2ddd98011574f66ae9e
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 89e54f19c04bb28c90f0ee75419a149c8178f9841435a20be727506d0c9506d3

Comments