MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 723712f4ccf1b680329260d9674a19f1ce7485111e8429224cd03b18977585d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 723712f4ccf1b680329260d9674a19f1ce7485111e8429224cd03b18977585d9
SHA3-384 hash: 96ab2411c4b6c3424e75983849bf1f040a423097fea7cbc90a1b98db39749aae1d470514f5618d2bb0ca82a5436c50a7
SHA1 hash: 8bc50a13d2b8dd76f86386de8b2800a8f801d4f8
MD5 hash: 30c40c0b62db499a8b67e6665e169559
humanhash: oscar-tennis-salami-alabama
File name:DHL invoice.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:85'987 bytes
First seen:2020-06-04 15:54:35 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:koR8WcW+SOrZXznpqtdxfmTq/LABxhCf5UG8RwgSW+XrU7jbfb4aXMYd4l:38FUcDngdBJ/LAu5hgSNXrU7XD4acYdo
TLSH 3E8302A68C43EC96A42845DD7AB20C39BFF75A4F138746162C729897E1C1B580673F7C
Reporter abuse_ch
Tags:DHL GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mails.cesosenintl.ml
Sending IP: 193.142.59.85
From: The DHL MyBill Team <track@dhl.com>
Subject: Your latest DHL invoice : USDEFI001454105
Attachment: DHL invoice.rar (contains "DHL invoice.exe")

GuLoader payload URL:
https://qif.ac.ke/komi_yUyfmoyRdV90.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 16:36:39 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oi3rf5gm6g3iamusmdmwosqz6hhhjbird2ccsism2a5rrf3vqxmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 723712f4ccf1b680329260d9674a19f1ce7485111e8429224cd03b18977585d9

(this sample)

GuLoader

Executable exe 686dbdd1993e0a6efdcdf33f20d8538f200f8166c57db016cbf342d112d396bd

  
URLhaus
https://urlhaus.abuse.ch/url/365819/
  
Dropping
MD5 c3f1a4bed35eb120be24221299a3579f
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 686dbdd1993e0a6efdcdf33f20d8538f200f8166c57db016cbf342d112d396bd

Comments