MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ee8bf6666e32639d6027f22fd7aa517987c3066aaa1f5cd4b96019e8ff2ba30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ee8bf6666e32639d6027f22fd7aa517987c3066aaa1f5cd4b96019e8ff2ba30
SHA3-384 hash: 9d686c0855cc0e90dc88f8a4c00ec59c9b9846b6be5dd1fe9cda1e16e34b3ca9a5f7414481bf37f8ff07b31c3b7cff52
SHA1 hash: b1603fd08a01b079fd5f81e1c5e598ee2be8f3bc
MD5 hash: daa303f321add1620764bb2be90a957c
humanhash: sierra-romeo-maine-quebec
File name:rechnung.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:147'340 bytes
First seen:2020-06-04 10:47:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:Li7y3y70o1vd39euMKt3qlI+OzMgkbXWXn6q3wWubKP4quqtx:g70oFWvOzMgkbXWXn7wWKKPfuq3
TLSH A4E3127A45B56184EBAB8700386736D1DEB8A3F448CD9DAF406F831D1FA0346F0C99A7
Reporter abuse_ch
Tags:DEU geo GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mxout01.bytecamp.net
Sending IP: 212.204.60.217
From: DKV EURO SERVICE GmbH + Co. KG <rusty@sumaco.ae>
Subject: AW: AW: Zahlungsbeleg und Auftragsbestätigung 04-06-20 Rechnung_20-613129926-001
Attachment: rechnung.zip (contains "rechnung.exe")

GuLoader payload URL:
http://156.96.118.179/slxslx-2RAW_gwKBF147.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
MiscreantPunch.SingleXOR.EXE.197.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23811.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Virus.Floxif
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 11:35:53 UTC
AV detection:
37 of 48 (77.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n3ul6ztg4mtdtvqcp4rp26vfc6mhymdgvkq7ltklsyaz5d7sxiya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 6ee8bf6666e32639d6027f22fd7aa517987c3066aaa1f5cd4b96019e8ff2ba30

(this sample)

GuLoader

Executable exe 85a40f3f59fb797494adf184b0dbee2b3d8089e9686b9f484c5242c5a75085a9

  
URLhaus
https://urlhaus.abuse.ch/url/374619/
  
Dropping
MD5 1e6648567a03b5f9ae815edffbeead8c
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 85a40f3f59fb797494adf184b0dbee2b3d8089e9686b9f484c5242c5a75085a9

Comments