MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ed92cbf4186253af319c8e4e2ba573e1b2172bf557855f9db408e292d084779. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ed92cbf4186253af319c8e4e2ba573e1b2172bf557855f9db408e292d084779
SHA3-384 hash: 3ae6e130125b073c3fe8f13246c8fbdb6232683f18d23b155fbe7fb24c38f95bcc8bea76399bc368c8ddfa60733b823b
SHA1 hash: b94a27a5176458103be4f4b0054850b3791bc4ca
MD5 hash: 7bc70352123938431b7e825f642c1fe9
humanhash: social-winter-lamp-coffee
File name:New Purchase Order_RFQ-2121099457,pdf.iso
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'052'672 bytes
First seen:2020-05-01 13:22:50 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:Si2KmIpZ7l+/yO3VhZjgMU4eB7hqcXdd87ecxBOPY4Jvjg3FVLg904yp4lFB:SFGl0ycAF1ddUeqBOPYovEZ4y+f
TLSH A225A062B2C04877D0731E78DD1B93689827BD612A3468C677F93D4C9F393A13A39297
Reporter abuse_ch
Tags:GuLoader iso nVpn RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server2-ip13.mailsentinel.net
Sending IP: 111.90.139.20
From: IBCC CO., LTD <kimsinae@ibcc.co.kr>
Subject: New Purchase Order_RFQ-2121099457
Attachment: New Purchase Order_RFQ-2121099457,pdf.iso (contains "New Purchase Order_RFQ-2121099457,pdf.exe")

GuLoader pushing RemcosRAT from drive.google.com

RemcosRAT C2:
thankyoulord.ddns.net:5050

Pointing to nvpn:

% Information related to '91.193.75.0 - 91.193.75.255'

% Abuse contact for '91.193.75.0 - 91.193.75.255' is 'abuse@kgb-vpn.org'

inetnum: 91.193.75.0 - 91.193.75.255
netname: NON-LOGGING-VPN-SERVICE
descr: Please note that we don't store any user data.
descr: Our main effort is not to make money, but to preserve values like the
descr: freedom of expression, the freedom of press, the right to data protection
descr: and informational self-determination.
descr: We ask all employees of Spamhaus and all self-proclaimed deputy sheriffs
descr: to stop your attacks against us.
country: EU
admin-c: KA7109-RIPE
tech-c: KA7109-RIPE
org: ORG-KHd1-RIPE
status: ASSIGNED PI
mnt-by: RIPE-NCC-END-MNT
mnt-by: KGB-MNT
mnt-routes: KGB-MNT
sponsoring-org: ORG-MW1-RIPE
created: 2012-06-04T11:05:55Z
last-modified: 2019-12-05T05:39:00Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Remcos-7735852-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-02 00:34:39 UTC
File Type:
Binary (Archive)
Extracted files:
58
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l3mszp2bqystv4yzzdsofosxhynsc4v7kv4fl6o3ichcsliii54q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso 5ed92cbf4186253af319c8e4e2ba573e1b2172bf557855f9db408e292d084779

(this sample)

GuLoader

Executable exe db28682ec511e61fa9a6425d0c7a908a99cf19b3f08c81b0e61bec26e24a15d6

  
Dropping
MD5 ddeb047a26a3c96c3ca82d07c67ffba6
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 db28682ec511e61fa9a6425d0c7a908a99cf19b3f08c81b0e61bec26e24a15d6

Comments