MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 749c6935f0db10685ba380c7cd5e6d62447e3bece08cd511af97c73ebec45c85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 749c6935f0db10685ba380c7cd5e6d62447e3bece08cd511af97c73ebec45c85
SHA3-384 hash: 0efe3a13feed15dd58eebdea5943ff0285b53fd24c880d42369fb2b13fc26f401b4c750ed505e6bb35aaf6fea8a656a4
SHA1 hash: 46c134c824ac8c8068e9d16110c2f4fb62285f03
MD5 hash: 8994a5b58be5def47b809e3c37cd62b6
humanhash: uniform-cat-finch-illinois
File name:INVOICE DRAFT COPY_scan00282733387_img.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:163'840 bytes
First seen:2020-06-03 13:32:35 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:DSPfxV40Icu19nYpqvzNkgrKHxLdGKc+o0FDHdZ1gIcDk0s+r8lb+K4h66:mPXIpvnYwKVdhjFD9zhKVh6
TLSH FCF37B17ED4C8613D15447BC2E578EB93A1DAD0A0D405BEFB47C5E9BAF322522CAB10E
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail2527.himayadar.org
Sending IP: 188.138.125.244
From: Nylene Criste <info@mail2525.himayadar.org>
Subject: INVOICE DRAFT COPY
Attachment: INVOICE DRAFT COPY_scan00282733387_img.img (contains "INVOICE DRAFT COPY_scan0091627_IMG.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=19oX2TzERMvZbM2LlNdcjGcqtWS_xpipk

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.NetWire-7996875-0
Create hunting rule

Win.Malware.Razy-7997182-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Razy
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 13:37:40 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=osogsnpq3migqw5dqdd42xtnmjch4o7m4cgnkenps7dt5pwelscq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 749c6935f0db10685ba380c7cd5e6d62447e3bece08cd511af97c73ebec45c85

(this sample)

GuLoader

Executable exe 8797d399b8d6448ae58dfb5c4c5d21aac717fab0b4629cd78748a8239ba87cd9

  
URLhaus
https://urlhaus.abuse.ch/url/376028/
  
Dropping
MD5 4863bd58de063e3f5b5af3244da75063
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8797d399b8d6448ae58dfb5c4c5d21aac717fab0b4629cd78748a8239ba87cd9

Comments