MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60a7c828e456f656304107e7cde9138d0fdc0470393825c64b022743491c5904. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 5 Yara Comments

SHA256 hash: 60a7c828e456f656304107e7cde9138d0fdc0470393825c64b022743491c5904
SHA1 hash: bfce61ac152a6785c631d59912d7cc2b13b7d6f1
MD5 hash: f3a444f39c60ebb786abfa425654e78f
File name:HT_20200522.IMG
Download: download sample
Signature GuLoader
File size:1'245'184 bytes
First seen:2020-05-22 09:50:33 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:ef5HO0KF/W/8T7b3Zv7h1FC0SRoInjplerAoOYp:efkTNR3Zv7hrC0+oIjplev
TLSH 9E454A20B2949D65DD818EB2CD665AD512FEBC311D054F0BB68D3B2D2B37A823D2C379
Reporter @abuse_ch
Tags:geo GuLoader img KOR


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm35.hanmail.net
Sending IP: 203.133.180.223
From: 이한석 <ldhun01@daum.net>
Subject: 긴급 견적의뢰
Attachment: HT_20200522.IMG (contains "HT_20200522.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1mAQgZjenc9yoRV13wo5A5zN0z8CfVDfP

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 18
Origin country FR FR
ClamAV Win.Dropper.Vebzenpak-7866175-0
VirusTotal:Virustotal results 11.32%
ReversingLabs :No data

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 60a7c828e456f656304107e7cde9138d0fdc0470393825c64b022743491c5904

(this sample)

  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment

Comments