MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ff4b7dbddb22448c27404bb18c152a5f619ef8a3b2d6b2f56997e4e52986e2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ff4b7dbddb22448c27404bb18c152a5f619ef8a3b2d6b2f56997e4e52986e2e
SHA3-384 hash: cfb5464e2959f483dea4942396873817b1a75e2648687dc93e601d02df24f8bce73cb682886b608d132d6340dbc44b39
SHA1 hash: b97255c06f6f208424a4e8ea5e074096e147e760
MD5 hash: 52635c16c5953e1785ca8dbfc2e0aff5
humanhash: two-coffee-table-lake
File name:PO_BB908.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:34'552 bytes
First seen:2020-05-26 09:16:52 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:/oHGvr8A/OyxSge65vLMPHe35omBKYO5ZeUMLwjCl23H:Amz8gOyxSgvMPKO5Ax8X
TLSH 04F2E1FACC42A4C51F548D6092ADD88163F70C58F3EEAEAE2181A0D2D446A0D6D56DAF
Reporter abuse_ch
Tags:GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: slot0.cherters.net
Sending IP: 45.95.168.241
From: Catherine <sales02@cherters.net>
Subject: RE:REQUIREMENT ORDER 5000PCS
Attachment: PO_BB908.gz (contains "PO#BB908.com")

GuLoader payload URL:
https://conveyancing.pro/wp-admin/js/widget/bb_RSmrk117.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 09:37:03 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 7ff4b7dbddb22448c27404bb18c152a5f619ef8a3b2d6b2f56997e4e52986e2e

(this sample)

GuLoader

Executable exe b092a330b736b90c25196d0784455f5d605aae83dca16f8569451236204d0976

  
URLhaus
https://urlhaus.abuse.ch/url/368710/
  
Dropping
MD5 cb56179b3632695f166121507d0310c0
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b092a330b736b90c25196d0784455f5d605aae83dca16f8569451236204d0976

Comments