MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ab08718d7087e98e36f753588143952250177ac8f5f341e002197f67752bce4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ab08718d7087e98e36f753588143952250177ac8f5f341e002197f67752bce4
SHA3-384 hash: 4e5975c40c66b30a8155e99ac19b23c4c177b185b418c185f945e3d800b499beb46e7b8449e00222a8f457907be98026
SHA1 hash: 9ba28aec522830f71b6d2a4cf94293a52aa2171c
MD5 hash: 475a7dd490c760844974da412e2f194d
humanhash: four-eight-angel-eleven
File name:4811_Invoice_confirmation.iso
Download: download sample
Signature GuLoader
Create hunting rule
File size:131'072 bytes
First seen:2021-01-04 18:01:56 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 1536:5QuuebxZ4uZ74rl/SlrqbJ4nR36oapO0:wK3W6lrMJ4R36oC
TLSH FDD30812A210E0F1F9D38ABC09EBAE985D136D7039799943F48E375B1BB36CD5624332
Reporter abuse_ch
Tags:GuLoader iso


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail.alrashid-hospital.com
Sending IP: 80.90.163.106
From: Peter Hamilton <regi1@lifedesignmethod.jp>
Subject: 'Payment Confirmation'
Attachment: 4811_Invoice_confirmation.iso (contains "4811_Invoice_confirmation.exe")

GuLoader payload URL:
https://victoragboifo.com/ven/janomo_KcrWqE35.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
268
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Gen.NN.ZevbaF.34700.em0@aKEfZjcb.27777.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ab08718d7087e98e36f753588143952250177ac8f5f341e002197f67752bce4/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lkyioggxbb7jry3pou2yqfbzkisqc55mr5ptihqaegl7m52sxtsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5ab08718d7087e98e36f753588143952250177ac8f5f341e002197f67752bce4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso 5ab08718d7087e98e36f753588143952250177ac8f5f341e002197f67752bce4

(this sample)

GuLoader

Executable exe c9d7f04210c5731d1879ba3f8c36e06dcf872b28766629225e8aa583e52a5574

  
URLhaus
https://urlhaus.abuse.ch/url/948916/
  
Dropping
MD5 f18fb522632227b5d12f4ab06c607e3d
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c9d7f04210c5731d1879ba3f8c36e06dcf872b28766629225e8aa583e52a5574

Comments