MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7aaae8eb8ba70ee52e292323c2a10779216781b6fbfcdcfec68a7373dea9551b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7aaae8eb8ba70ee52e292323c2a10779216781b6fbfcdcfec68a7373dea9551b
SHA3-384 hash: 72da2e15ccaa8e467093f1903fde4ba6e16b32a16f0eb16779317a3e01be315fc112876bcc054189a63e9a6ec5eeb54c
SHA1 hash: 7a9686b32de3b2c4aac78edc52b25636efd9be6d
MD5 hash: 9cc1f85961d21ea578d7435b3b1da53f
humanhash: berlin-bravo-glucose-lake
File name:PaymentSlip034.pdf.z
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-02 11:01:12 UTC
Last seen:Never
File type: z
MIME type:application/x-iso9660-image
ssdeep 1536:v5m+uKvBeNRYvvXXXbZZ/KTBgMFfIg8P3yD28xb0UAG:aaXXVYl9Sg8/geUAG
TLSH AC45A6597A54C06DF9414B3291EA82EB391CEDB1E916455F313BFD0A6B30D422CE2F39
Reporter abuse_ch
Tags:GuLoader z


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: slot0.veresegyhaz.tk
Sending IP: 192.236.147.248
From: Audra (M) Sdn. Bhd<sales@veresegyhaz.tk>
Subject: Requesting Balance Payment Confirmation
Attachment: PaymentSlip034.pdf.z (contains "PAYMENTS.SCR")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1QctpCKpRHrw9_oTuEq1lYBn6_pVHRbzw

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.NetWire-7993073-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 22:10:02 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pkvor24lu4hoklrjemr4fiihpeqwpanw7p6nz7wgrjzxhxvjkunq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

z 7aaae8eb8ba70ee52e292323c2a10779216781b6fbfcdcfec68a7373dea9551b

(this sample)

GuLoader

Executable exe 397d78ef032cac6fc37be9719672f02cd4df36135977079fca7b4a45a4ae352a

  
URLhaus
https://urlhaus.abuse.ch/url/373523/
  
Dropping
MD5 3eba7a28bef19841ad7171f35ee753d7
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 397d78ef032cac6fc37be9719672f02cd4df36135977079fca7b4a45a4ae352a

Comments