MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83b3f6acd51cdeeea22bf1f6796ba7a90ad1a0a49585225b91b1d19fb9e20934. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 83b3f6acd51cdeeea22bf1f6796ba7a90ad1a0a49585225b91b1d19fb9e20934
SHA3-384 hash: c801280fb74640a70a05c75bee11303019ccfbf00795294736f694b1c9d998554aaac8c1c43db8d0d2d06d1b929a0936
SHA1 hash: ee8a13a80d27b1e4df6e81c9190d75fdd0d86c69
MD5 hash: 98d6309bdb36036a9ca83b17a42fafc8
humanhash: moon-montana-queen-arizona
File name:INV PI.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:28'904 bytes
First seen:2020-05-27 17:35:45 UTC
Last seen:2020-05-27 17:36:49 UTC
File type: rar
MIME type:application/x-rar
ssdeep 768:K6rt7JKjTSJMct+f2yQvm7RqdATyEUvrUhdnSJZ2RsDF:9r+Szt+fVQ+9JyhvhZoWF
TLSH C1D2F12F4F6889E62A31E43BBDE0605E750F04858AEDF97249770953A448393CEDEE03
Reporter abuse_ch
Tags:GuLoader Outlook rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: NAM12-MW2-obe.outbound.protection.outlook.com
Sending IP: 40.92.23.92
From: larry herman <lher41@hotmail.com>
Subject: RE: INVOICE & PI
Attachment: INV PI.rar (contains "INV & PI.exe")

GuLoader payload URL:
http://ratamodu.ga/~zadmin/iclient/sean_SgXXorh87.bin

Intelligence

File Origin
# of uploads :
2
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Formbook
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 02:26:00 UTC
AV detection:
13 of 30 (43.33%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 83b3f6acd51cdeeea22bf1f6796ba7a90ad1a0a49585225b91b1d19fb9e20934

(this sample)

GuLoader

Executable exe 4c841c5e0c2382fae670d7f41f7a75f8d8b2c1a03ff7d7c31eff98c1d9912308

  
URLhaus
https://urlhaus.abuse.ch/url/365502/
  
Dropping
MD5 0ecbddd32a7d93b8f4857f0070f2c28b
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4c841c5e0c2382fae670d7f41f7a75f8d8b2c1a03ff7d7c31eff98c1d9912308

Comments