MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6523cec93d68e38809ee7a9da3121fd5e535d2755828f668aa507a0b0d18b1e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: 6523cec93d68e38809ee7a9da3121fd5e535d2755828f668aa507a0b0d18b1e4
SHA1 hash: 5b9ca74f20e9db78f159f613edf15d2596dcb8e9
MD5 hash: 76390b2700d20925f6372f1302eca538
File name:SWIFT TRANSFER COPY.pdf.bat
Download: download sample
Signature GuLoader
File size:94'208 bytes
First seen:2020-05-22 15:04:47 UTC
Last seen:2020-05-22 15:48:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c2d4474df1bb9123c0455d0bf495a4ce
ssdeep 768:Tz+KtZa61wBpdMJKWOXl1T/eyEXPqHIzM3HctpLPmXCN1taJxqHhxCPzmzLry98:n+3VBp2JN4XoXC3HMTxwmvt
TLSH C79319327690DD96E5298FB00D7687680477BD791A000F1B32CD3B5E6D33A8EAA7135B
Reporter @abuse_ch
Tags:bat GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: pro03.emailserver.vn
Sending IP: 103.15.48.223
From: ACCOUNTING <kt_1@achison.com>
Subject: RE: Payment Receipt
Attachment: SWIFT TRANSFER COPY.pdf.r07 (contains "SWIFT TRANSFER COPY.pdf.bat")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1zpSdW4Tji4URCA69dGKz-v62r_7LJazk

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 26
Origin country US US
ClamAV PUA.Win.Packer.ProtectSharewar-2
PUA.Win.Packer.ProtectSharewar-3
VirusTotal:Virustotal results 16.90%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 6523cec93d68e38809ee7a9da3121fd5e535d2755828f668aa507a0b0d18b1e4

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments