MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6370e0d7cf9e5c600b56cf62b54b8b384d6a71c2098d541531c70bc88b84d31a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6370e0d7cf9e5c600b56cf62b54b8b384d6a71c2098d541531c70bc88b84d31a
SHA3-384 hash: f020f91bb434356831c0b7e3aff7d3a88e92fccf72f4eeef7ed507b8410a29c202a22cb91e687170592fb72d3e6a7d37
SHA1 hash: af044c85951af4977676d09c628f822a07a9648e
MD5 hash: 014d6782663a3fff4115388de401dcac
humanhash: floor-rugby-fruit-whiskey
File name:28487.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:20'271 bytes
First seen:2020-05-26 09:15:37 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:dckbiBfqoP4kKFEK3j1kqf9R/rBOTDqfyQmQk+gAJF35DGKzaVOwyaX:dcQiBfk1k69R/rBOTD1L+gAJR5KXVOaX
TLSH 4392E1F33993FA500243BB866788DB7F9EB9BF524F64121D6C9B9104D021D52CEB7640
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: yuntong-batt.co
Sending IP: 111.90.141.203
From: Ling Chen <Chen@yuntong-batt.co>
Subject: RE: PO REQUEST 20200525
Attachment: 28487.rar (contains "#28487.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1SBIGqDBZXHDLYsvO5PTE_aeousOUOsRf

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Rdn
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 09:36:55 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 6370e0d7cf9e5c600b56cf62b54b8b384d6a71c2098d541531c70bc88b84d31a

(this sample)

GuLoader

Executable exe 6c7d10402361556d564ce74e16a05024a4e0ad31da03b98fb69d4f7c0079730f

  
URLhaus
https://urlhaus.abuse.ch/url/368705/
  
Dropping
MD5 b4aceb96c8e0dc2ae9e5ae62ded78a32
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6c7d10402361556d564ce74e16a05024a4e0ad31da03b98fb69d4f7c0079730f

Comments