MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 66d8f8717b562766ee00c65c7d0a592e12e31ceed653ecb7b739c08014428ee7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 66d8f8717b562766ee00c65c7d0a592e12e31ceed653ecb7b739c08014428ee7
SHA3-384 hash: 458774cca8405de28d4bc25d5e45f31626e4c0f127cdd9bd7b233cd44f4cf9ed7f32212e7883f05a4575246a64af3445
SHA1 hash: 25bbdd88566bd597ce3bf68ace40160979614aea
MD5 hash: 3ce579acd556e1c185049fc0664db0a0
humanhash: hawaii-lactose-texas-washington
File name:Order03092020_pdf.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:28'733 bytes
First seen:2020-09-03 04:38:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:s10N4JDSVFWcKQSxMuO15cet4I2LN+YRGLGSfmHJ1tTYbVhxEzwpPgnbOW9ud768:a0NADSVEdMu0ce+Gf+pTCVDKW4Ea6q2
TLSH 24D2D12BFD7BB398CAED1038D70D3D10A6A9E90841B1449A8C7DDBDC651002B7A7F598
Reporter cocaman
Tags:GuLoader zip


Avatar
cocaman
Malicious email
From: "Purchase Dept" <Purchase3@915.drxvivo.gq>
Received: from nsen0.915.drxvivo.gq (nsen0.915.drxvivo.gq [167.99.146.208])
Date: Wed, 02 Sep 2020 16:40:35 -0700
Subject: Order Inquire
Attachment: Order03092020_pdf.zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
207
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/66d8f8717b562766ee00c65c7d0a592e12e31ceed653ecb7b739c08014428ee7/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-09-03 00:23:50 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m3mpq4l3kytwn3qayzoh2cszfyjoghho2zj6zn5xhhaiafccr3tq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DriveBy Activity
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/66d8f8717b562766ee00c65c7d0a592e12e31ceed653ecb7b739c08014428ee7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 66d8f8717b562766ee00c65c7d0a592e12e31ceed653ecb7b739c08014428ee7

(this sample)

GuLoader

Executable exe 341f33c1103bf6340261fe146a5bded870d67a30e6a55ad9ef503fad17f33e60

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 341f33c1103bf6340261fe146a5bded870d67a30e6a55ad9ef503fad17f33e60

Comments