MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ba1021aa7ca0d20da2e205ff413a3153f4f3bb444a8a2bdfc0d97d3348b84be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: 7ba1021aa7ca0d20da2e205ff413a3153f4f3bb444a8a2bdfc0d97d3348b84be
SHA1 hash: 0c11fbfb1c3ea73bbd0c3b89a6b3d20d28b26d8c
MD5 hash: 76f8047e5597613a7f6f2ca1f08a8580
File name:DEMURRAGE CLAIM.exe
Download: download sample
Signature GuLoader
File size:90'112 bytes
First seen:2020-05-22 09:55:48 UTC
Last seen:2020-05-22 10:51:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2bab0a439dedb9f20f753b169ad4c2a5
ssdeep 768:F+N8JfR9I3olo7JU6mtS2CffqyA9HNahbBYJqZgMf9xdl2s:AN8Jfz00o7O6sS2CfSyAe3jL1
TLSH 81934C1575ACECD6C8248DF14B2286D411ABFD312B59CF0B35D5BB6C193B9EB1E28306
Reporter @abuse_ch
Tags:exe GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: whm.mastertindo.com
Sending IP: 103.103.192.221
From: Stan Lee/Lin & Associates, Maritime Law Office <stanlee@lamariti.com.tw>
Subject: RE : URGENT !!! DEMURRAGE CLAIM
Attachment: DEMURRAGE CLAIM.zip (contains "DEMURRAGE CLAIM.exe")

GuLoader payload URL:
https://ny.yummyeliquid.info/mana.bin

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 23
Origin country FR FR
ClamAV SecuriteInfo.com.Variant.Ursu.878098.19116.2554.UNOFFICIAL
VirusTotal:Virustotal results 24.66%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 7ba1021aa7ca0d20da2e205ff413a3153f4f3bb444a8a2bdfc0d97d3348b84be

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments