MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 604aa44e93bb1fa423997df155cb941c5163723e1075182c80b4b9a5e5b4a768. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 604aa44e93bb1fa423997df155cb941c5163723e1075182c80b4b9a5e5b4a768
SHA3-384 hash: 3590d2161f114035a5fb8e0b4f4528194766849688ed59d9a24b8bc7ab122e40c342c94b9506124b292bc3a76981f1ec
SHA1 hash: 936adef06a76fe84a9b9a285764e9b8ad2b19b12
MD5 hash: ad0acd6357140bc9830283e198be84a0
humanhash: georgia-cardinal-dakota-queen
File name:DOC 13102021.r15
Download: download sample
Signature GuLoader
Create hunting rule
File size:64'783 bytes
First seen:2021-10-13 14:18:13 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:be5agoj8fHY47NXB8CF2eRKjUywTubUynes:bqoA4+NXB8C9GUy9Pes
TLSH T16C5302A49EE95CB1697D00FA6DFB84557602F2C1624DAC7B3D9B38831C2D32CC49E476
Reporter cocaman
Tags:GuLoader r15 rar


Avatar
cocaman
Malicious email (T1566.001)
From: "sun.ling.tan@kerry.com" (likely spoofed)
Received: "from kerry.com (unknown [185.222.58.120]) "
Date: "13 Oct 2021 16:08:38 +0200"
Subject: "Shipping docs-Taleen-SO 17958499"
Attachment: "DOC 13102021.r15"

Intelligence

File Origin
# of uploads :
1
# of downloads :
205
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6166eadefd35fe780c3d6961/reports/b31283b2-24cf-4f1e-bc17-f53c5c6ea3d7/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/604aa44e93bb1fa423997df155cb941c5163723e1075182c80b4b9a5e5b4a768/
Threat name:
Win32.Trojan.Mucc
Create hunting rule
Status:
Malicious
First seen:
2021-10-13 14:19:10 UTC
AV detection:
4 of 33 (12.12%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mbfkitutxmp2ii4zpxyvls4udriwg4r6cb2rqleaws42lznuu5ua._file
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader downloader
Link:
https://tria.ge/reports/211013-rmdlxaebbn/
Behaviour
Suspicious use of SetWindowsHookEx
Guloader,Cloudeye
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/604aa44e93bb1fa423997df155cb941c5163723e1075182c80b4b9a5e5b4a768

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 604aa44e93bb1fa423997df155cb941c5163723e1075182c80b4b9a5e5b4a768

(this sample)

GuLoader

Executable exe e1940206b5e3300e88b817953a62d90a2e69b738df549dc5da993409a6487ae1

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e1940206b5e3300e88b817953a62d90a2e69b738df549dc5da993409a6487ae1

Comments