MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6789d90b69f71c6f867c1e0ae5add5d14b8cb81ed48b11bb70e8d895cd86891a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 4 Yara Comments

SHA256 hash: 6789d90b69f71c6f867c1e0ae5add5d14b8cb81ed48b11bb70e8d895cd86891a
SHA1 hash: de0fd517d94b06f56fd770132c7a1419b0b40f95
MD5 hash: 229f744b472f6c9d129f544c9769a29a
File name:ID00501Q0395524IDJKT_pdf.gz
Download: download sample
Signature GuLoader
File size:24'636 bytes
First seen:2020-05-22 10:15:23 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 384:Az788/Fr6PqfGY6EmQoryjxvwBeIS2GbKdJG5GgWYfjADqXeXI:Azo89rF//mQlxKhS2GbXiqOY
TLSH FAB2E0AB02B79D39DD368ACEF7E44741D84AE04E0C84959168F9F4CC1AEEC022679C96
Reporter @abuse_ch
Tags:GuLoader gz SCB

Malspam distributing GuLoader:

Sending IP:
From: Standard Chartered Bank <>
Subject: SUBJECT:Advice from Standard Chartered Bank
Attachment: ID00501Q0395524IDJKT_pdf.gz (contains "ID00501Q0395524IDJKT_pdf.exe")

GuLoader payload URL:


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 21
Origin country US US
ClamAV Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
VirusTotal:Virustotal results 10.17%
ReversingLabs :No data

File information

The table below shows additional information about this malware sample such as delivery method and external references.



gz 6789d90b69f71c6f867c1e0ae5add5d14b8cb81ed48b11bb70e8d895cd86891a

(this sample)

Delivery method
Distributed via e-mail attachment