MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 691b6128674bb8ae31b99de783e7521ec7294dbaaa680fac5327275fc0ae452f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 691b6128674bb8ae31b99de783e7521ec7294dbaaa680fac5327275fc0ae452f
SHA3-384 hash: d7a9980aa9bf745373b7b0be39d482fc60fbf10fc9d4f6727637e53a89e4768f5e17c197b848811ee1c72373ae32bf76
SHA1 hash: ba37f4197b4e2cf567cc1de96c5c472c6814d15f
MD5 hash: a5b728a0746f99d3d85ea9fe3d71f3d6
humanhash: alabama-ten-leopard-arizona
File name:Newster sterilizers.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:26'595 bytes
First seen:2020-04-10 09:49:56 UTC
Last seen:2020-04-10 19:02:41 UTC
File type: zip
MIME type:application/zip
ssdeep 384:d3icXfl/3rbpVmE4lX9w41AUh81M5eAWddXiwrzNYLPMafXoh/82Lk7R:tl5Vm1O4S71MBEheLxfohE2Lk7R
TLSH 7BC2F212C25CFF9AEB58BCFC42C8CEC94BD954BC321C4F85798B7D82258A1A5251873D
Reporter abuse_ch
Tags:COVID-19 GuLoader zip


Avatar
abuse_ch
COVID-19 themed malspam distributing GuLoader->AgentTesla:

HELO: newstergroup.com
Sending IP: 103.99.1.149
From: "Barbara Ann Calisesi" <research@newstergroup.com>
Subject: Newster COVID-19 treatment references
Attachment: Newster sterilizers.zip (contains "Newster sterilizers.exe")

GuLoader payload URL (AgentTesla):
https://drive.google.com/uc?export=download&id=1DL1XK4elHi-JMY7m4Z1OQgOPBzhxeUwA

Intelligence

File Origin
# of uploads :
2
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Fareit-7661431-0
Create hunting rule

Win.Dropper.Razy-7661440-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-04-10 10:35:25 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nenwckdhjo4k4mnztxtyhz2sd3dsstn2vjua7lcte4tv7qfoiuxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 691b6128674bb8ae31b99de783e7521ec7294dbaaa680fac5327275fc0ae452f

(this sample)

GuLoader

Executable exe c9dae8af9343e2bb59a9c6cbfa04b09bcbffe2a75893d797ec2a9c50c6253afe

  
URLhaus
https://urlhaus.abuse.ch/url/337876/
  
Dropping
MD5 350b3c96ccf51dc960c09af122d98721
  
Dropping
SHA256 c9dae8af9343e2bb59a9c6cbfa04b09bcbffe2a75893d797ec2a9c50c6253afe
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c9dae8af9343e2bb59a9c6cbfa04b09bcbffe2a75893d797ec2a9c50c6253afe

Comments