MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 832b8b8af81671ec21deb49eea38c2aa3ee96312a7370f0d1a4f29575af5ff07. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 832b8b8af81671ec21deb49eea38c2aa3ee96312a7370f0d1a4f29575af5ff07
SHA3-384 hash: 9a21167e34e7c3859004ff78ec63f8cc9f50c1e8a62c181cee412567e430174c56ccaefed2c8348e6642966b1c6119ea
SHA1 hash: 950d680e88e1c3c68daaa3c68981ca5191ad7c85
MD5 hash: a675e8f493bbdcf1c0b471f98e90aea9
humanhash: ten-kansas-don-london
File name:AWB0198273-20-05-20.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-21 15:35:47 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:M6gozkgLQ9WzbaT8Ff0/VYyI/G4olHE4b1PTkeaj:VMwQ9Wr+/VU/jqE4JoV
TLSH 4245F95133D1B926D9ED0DF21AB15284A3AEBC3D6902570F37CC7A1E8B33940A7617E6
Reporter abuse_ch
Tags:DHL GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail.strongmailvault.com
Sending IP: 111.90.144.214
From: Notificacion DHL Express (ChiIe) <notificacion@dhl.com>
Reply-To: bbnet3823@gmail.com
Subject: AVISO DE LLEGADA ENVIO CON (Guía Aérea:8158025864)
Attachment: AWB 0198273-20-05-20.IMG (contains "AWB 0198273-20-05-20.exe")

GuLoader payload URL:
http://kuroilersuganda.com/bin_eEEqu145.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 02:51:26 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 832b8b8af81671ec21deb49eea38c2aa3ee96312a7370f0d1a4f29575af5ff07

(this sample)

GuLoader

Executable exe 7628bdfdefa90c3dde24286daa4292bd93f6a95b9c95ed0e64df8e7df9a13289

  
URLhaus
https://urlhaus.abuse.ch/url/366244/
  
Dropping
MD5 3420f18ad3b26cb5f964c0fbfe29e299
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7628bdfdefa90c3dde24286daa4292bd93f6a95b9c95ed0e64df8e7df9a13289

Comments