MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fc23e159d21753ca7140091700214b2c277d0f94e80280b58bbfda43930e7d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: 5fc23e159d21753ca7140091700214b2c277d0f94e80280b58bbfda43930e7d2
SHA1 hash: 09844f070500aaec2c7813fd039c4fad2f259a03
MD5 hash: 95211084ca6d765254538d958da1dc33
File name:PAYMENT INSTRUCTIONS COPY.scr
Download: download sample
Signature GuLoader
File size:94'208 bytes
First seen:2020-05-22 15:03:44 UTC
Last seen:2020-05-22 15:48:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9dcb714004172e9d71fd31bf582c76b3
ssdeep 768:kQPBlfs1TSo56Yh2h+x/lUOzen6fLTgnmpDmzGxRJel5OjjxPN1xXtMM1t:jPB8bh2GaOzen6DTgEk2xPTF3
TLSH 58931A2A7290EDA7CA650FF12D75D6DC182BFC3029144B4370D53B2D7A3398AA875357
Reporter @abuse_ch
Tags:GuLoader scr


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: ss0109.hostingcare.net
Sending IP: 138.128.162.42
From: Faye Segal <info@drivus-industry.com>
Reply-To: ukcompany20@yahoo.com
Subject: RE: PAYMENT INSTRUCTIONS
Attachment: PAYMENT INSTRUCTIONS COPY.gz (contains "PAYMENT INSTRUCTIONS COPY.scr")

GuLoader payload URL:
http://creativewg.com/baby_zLlTwqAf177.bin

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 24
Origin country US US
ClamAV PUA.Win.Packer.ProtectSharewar-2
PUA.Win.Packer.ProtectSharewar-3
VirusTotal:Virustotal results 16.67%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 5fc23e159d21753ca7140091700214b2c277d0f94e80280b58bbfda43930e7d2

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments