MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 66c4b095722a3fedbc6c0279c57615abc384934fbdf91054d7d382ccd2560890. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: 66c4b095722a3fedbc6c0279c57615abc384934fbdf91054d7d382ccd2560890
SHA1 hash: 89b77085cdf18db0849bf47bb84c9a02eac38ca3
MD5 hash: b4d42b1927a4d35370f8d279037929a4
File name:Payment Copy.bat
Download: download sample
Signature GuLoader
File size:102'400 bytes
First seen:2020-05-22 10:20:45 UTC
Last seen:2020-05-22 10:52:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1da7267f085267e2ee7d09136a66b4bc
ssdeep 768:wcQFOX4zLlcWlXytiFqTq52/R3NTTfPcMFdvUq5/uXHwxFTTwlv79d4UC9XKF/U:n4cmX6V/R57P/7/uXHoTwUUCMO
TLSH 5AA31A11FA949C52E9C45DF22AA68EB4102FFC7129464F0B70CFB75D2D32E87E52631A
Reporter @abuse_ch
Tags:bat GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: mx.shi-ig.com
Sending IP: 217.61.123.234
From: jeff@shi-ig.com
Subject: Re:Payment copy
Attachment: Payment Copy.zip (contains "Payment Copy.bat")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1dje1f5MKekSEqm5EHUuqTF-64jLzc6Hn

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 24
Origin country FR FR
ClamAV SecuriteInfo.com.Trojan.DownLoader33.44126.29095.12728.UNOFFICIAL
VirusTotal:Virustotal results 16.67%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 66c4b095722a3fedbc6c0279c57615abc384934fbdf91054d7d382ccd2560890

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments