MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 799728fafc81d892400d71f5c94800877be1ce039649779cc2fdada89861cf39. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 799728fafc81d892400d71f5c94800877be1ce039649779cc2fdada89861cf39
SHA3-384 hash: f363f48c6f9ff86eacc6f9a3e00a03aaa14306cae04fc43c1590e2ec5755b0158059f10aab4d672136b2c271a749cb62
SHA1 hash: 25977a4ddaa99b7b77e5db54c08a1933fc7b618a
MD5 hash: e72ce5397642b9bb0125110e41c15ac6
humanhash: asparagus-south-india-double
File name:PO4014.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:77'067 bytes
First seen:2020-06-04 06:03:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:Lv1cdSa1B+Jsx9wG/j8GEtJK88xLJEIKH6wPorq7:LUT+KgGYGm01GVawPorq7
TLSH 1E73029E86DE8FD7BD606DFB82D25344F14B8F8965B2605B21B245B122CB03D913273B
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail925.hm1479.locaweb.com.br
Sending IP: 177.153.9.25
From: HerwinServices <info@herwinservices.com>
Subject: Samples Information
Attachment: PO4014.zip (contains "PO4014.exe")

GuLoader payload URL:
http://thugesh.cf/cgi/KWA40.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 03:57:05 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pglsr6x4qhmjeqanoh24ssaaq556dtqdszexphgc7ww2rgdbz44q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 799728fafc81d892400d71f5c94800877be1ce039649779cc2fdada89861cf39

(this sample)

GuLoader

Executable exe 7f75534af5e989dd99a02227f555d7fdb4b57396b2eb8fb02eb71623b857395e

  
URLhaus
https://urlhaus.abuse.ch/url/378968/
  
Dropping
MD5 4f40e5bf0a2128ea9966efcffd513046
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7f75534af5e989dd99a02227f555d7fdb4b57396b2eb8fb02eb71623b857395e

Comments