MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65b326a24a4e121ee31bb7f2c188f10a972a9c8e4998691afd7e426af0e53a87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65b326a24a4e121ee31bb7f2c188f10a972a9c8e4998691afd7e426af0e53a87
SHA3-384 hash: 15a5fe714d40d4a68c1d40f126969c9f9e3f715c787089a2459787eda8731903d25dcfce940ccf02b5cbb7187ec11671
SHA1 hash: dfe209411daf99ae9df279690a183cd5917f8838
MD5 hash: 0c385fcd87e55ad2777a6eee3fc6a8d8
humanhash: harry-avocado-august-alaska
File name:PO 6202020.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:44'560 bytes
First seen:2020-06-05 13:40:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:lhRFEHujgcHN3ugmppl5IVUJnD21giSsjhU9KJV1iELCRBr9OfixfbUVHLwm:l9gu9mblyVc0gxKdJVw/3kKU
TLSH A113F12A4EF6553ADF79791229310B89017E15D03FE88B0E92D0D1F68BA37478C7397A
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: nsv40.dnshostmaster.net
Sending IP: 124.150.141.125
From: Paul <paul@urbangroup.com.my>
Reply-To: paul@urbangroup.com.my
Subject: PO.6202020
Attachment: PO 6202020.zip (contains "PO #6202020.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=EAD0E1196BD04320&resid=EAD0E1196BD04320%211219&authkey=AKgo75RMvr4khlc

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23627.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 13:42:06 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mwzsniskjyjb5yy3w7zmdchrbklsvheojgmgsgx5pzbgv4hfhkdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 65b326a24a4e121ee31bb7f2c188f10a972a9c8e4998691afd7e426af0e53a87

(this sample)

GuLoader

Executable exe 743b0bd67e604e9e69acffcc8c7d56d8294de21c11c1a16cbeea94f82b6e5fa4

  
URLhaus
https://urlhaus.abuse.ch/url/379342/
  
Dropping
MD5 2a45a1584510256d4f4f838368433960
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 743b0bd67e604e9e69acffcc8c7d56d8294de21c11c1a16cbeea94f82b6e5fa4

Comments