MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84fc68bfd4ec4c3bf94f97a4454aa91c38851fcc9f83c0a31fba8f4307fadf4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 84fc68bfd4ec4c3bf94f97a4454aa91c38851fcc9f83c0a31fba8f4307fadf4c
SHA3-384 hash: bf275f39f6c11ab42076da8d19c867c062b082c03b8093916783411857640510b5ab199474e991084b3e9ea19e26f7c6
SHA1 hash: 1b91d5b884413412ac6c467808947e2d86d6d349
MD5 hash: 6f0e2c089fed6c78830b72e30deb1c5d
humanhash: timing-enemy-bakerloo-april
File name:T.T ..RFQ.r00
Download: download sample
Signature GuLoader
Create hunting rule
File size:40'674 bytes
First seen:2020-06-09 06:41:33 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 768:O6kIVmmh/ggSJnkgAHl8FxVVz1dGdsL0y1amNuCvXx8JJ2s:O6bAO4gSJzAHCr1dG+Lf1bNz+us
TLSH 7F03F1ECD5C92312A168470BC4B999F897A5FD8E117847D86901CB308422E37CB2F9EF
Reporter abuse_ch
Tags:GuLoader r00


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: total.tn
Sending IP: 192.227.246.82
From: Wassim BEN LAJNEF <Wassim.BENLAJNEF@total.tn>
Subject: Total Tunisia RFQ
Attachment: T.T ..RFQ.r00 (contains "T.T ..RFQ.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1gmVkukS9LBLQ13erHhK6HcBOy0YGtNiJ

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 06:43:08 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qt6grp6u5rgdx6kps6seksvjdq4ikh6mt6b4biy7xkhugb7235ga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

r00 84fc68bfd4ec4c3bf94f97a4454aa91c38851fcc9f83c0a31fba8f4307fadf4c

(this sample)

GuLoader

Executable exe 61422e082aca1bb6a4abd3271332453993bbb320a08fa39941bd1cecf16159d3

  
URLhaus
https://urlhaus.abuse.ch/url/384283/
  
Dropping
MD5 9b1d7846e49ca04399977a0136855b9e
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 61422e082aca1bb6a4abd3271332453993bbb320a08fa39941bd1cecf16159d3

Comments