MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ee45fdfe890e0199f1c72f05fd27218c358ddce153f85d4e683d3ba72dbc2d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: 6ee45fdfe890e0199f1c72f05fd27218c358ddce153f85d4e683d3ba72dbc2d8
SHA1 hash: f03776f012474f778b23830ac8d076a09bf7fb38
MD5 hash: 08146f38e5e4c5e24cd966ffb86db7b5
File name:rechnung1.exe
Download: download sample
Signature GuLoader
File size:114'688 bytes
First seen:2020-05-23 15:16:33 UTC
Last seen:2020-05-23 15:46:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a2f4fe572b89748ddf5bc8683f439988
ssdeep 768:Xq38w5qgkss1pcPnVk/3hZ2n009Tv3YhR828Viol2To2MYHmSP2:VUOcvVk/3v2xtYyVRl2ToDYHg
TLSH F9B30723F9E58CF5CE788FF24821D9B81EA6BC2168514F177B04BB4F15B36CA69A1205
Reporter @abuse_ch
Tags:DEU exe geo GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: dd37126.kasserver.com
Sending IP: 85.13.153.207
From: info@schloss-willebadessen.de
Subject: AW: AW: Zahlungsbeleg und Auftragsbestätigung 23-05-20 Rechnung_20-613129926-001
Attachment: Rechnung..zip (contains "rechnung1.exe")

GuLoader payload URL.
http://156.96.118.179/RSol.bin

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 23
Origin country FR FR
ClamAV SecuriteInfo.com.Gen.NN.ZevbaF.34122.hm0@a4UdGDpb.27553.UNOFFICIAL
VirusTotal:Virustotal results 15.28%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 6ee45fdfe890e0199f1c72f05fd27218c358ddce153f85d4e683d3ba72dbc2d8

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments