MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ee45fdfe890e0199f1c72f05fd27218c358ddce153f85d4e683d3ba72dbc2d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 3 File information Yara Comments

SHA256 hash: 6ee45fdfe890e0199f1c72f05fd27218c358ddce153f85d4e683d3ba72dbc2d8
SHA3-384 hash: aadbdb5f0b7e765f823dff3c96d9e0de65920e5e6f1c88508d78e1615623dec39683c6a0d908efdbd48d25d984a0986d
SHA1 hash: f03776f012474f778b23830ac8d076a09bf7fb38
MD5 hash: 08146f38e5e4c5e24cd966ffb86db7b5
humanhash: minnesota-undress-whiskey-salami
File name:rechnung1.exe
Download: download sample
Signature GuLoader
File size:114'688 bytes
First seen:2020-05-23 15:16:33 UTC
Last seen:2020-05-23 15:46:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a2f4fe572b89748ddf5bc8683f439988
ssdeep 768:Xq38w5qgkss1pcPnVk/3hZ2n009Tv3YhR828Viol2To2MYHmSP2:VUOcvVk/3v2xtYyVRl2ToDYHg
TLSH F9B30723F9E58CF5CE788FF24821D9B81EA6BC2168514F177B04BB4F15B36CA69A1205
Reporter @abuse_ch
Tags:DEU exe geo GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: dd37126.kasserver.com
Sending IP: 85.13.153.207
From: info@schloss-willebadessen.de
Subject: AW: AW: Zahlungsbeleg und Auftragsbestätigung 23-05-20 Rechnung_20-613129926-001
Attachment: Rechnung..zip (contains "rechnung1.exe")

GuLoader payload URL.
http://156.96.118.179/RSol.bin

Intelligence


File Origin
# of uploads :
2
# of downloads :
31
Origin country :
FR FR
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Genkryptik
Status:
Malicious
First seen:
2020-05-23 15:35:37 UTC
AV detection:
14 of 48 (29.17%)
Threat level
  5/5

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 6ee45fdfe890e0199f1c72f05fd27218c358ddce153f85d4e683d3ba72dbc2d8

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments