MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6789d90b69f71c6f867c1e0ae5add5d14b8cb81ed48b11bb70e8d895cd86891a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: 6789d90b69f71c6f867c1e0ae5add5d14b8cb81ed48b11bb70e8d895cd86891a
SHA1 hash: de0fd517d94b06f56fd770132c7a1419b0b40f95
MD5 hash: 229f744b472f6c9d129f544c9769a29a
File name:ID00501Q0395524IDJKT_pdf.gz
Download: download sample
Signature GuLoader
File size:24'636 bytes
First seen:2020-05-22 10:15:23 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 384:Az788/Fr6PqfGY6EmQoryjxvwBeIS2GbKdJG5GgWYfjADqXeXI:Azo89rF//mQlxKhS2GbXiqOY
TLSH FAB2E0AB02B79D39DD368ACEF7E44741D84AE04E0C84959168F9F4CC1AEEC022679C96
Reporter @abuse_ch
Tags:GuLoader gz SCB


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: 167jiv71v.ni.net.tr
Sending IP: 95.173.179.167
From: Standard Chartered Bank <send@asmobilya.com.tr>
Subject: SUBJECT:Advice from Standard Chartered Bank
Attachment: ID00501Q0395524IDJKT_pdf.gz (contains "ID00501Q0395524IDJKT_pdf.exe")

GuLoader payload URL:
https://fvkreklam.com/my%20okao_OExXxsd33.binhttps://cmdtech.com.vn/my%20okao_OExXxsd33.bin

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 21
Origin country US US
ClamAV Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
VirusTotal:Virustotal results 10.17%
ReversingLabs :No data

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 6789d90b69f71c6f867c1e0ae5add5d14b8cb81ed48b11bb70e8d895cd86891a

(this sample)

  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment

Comments