MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85da31a80a4d9abbb63b08026620b12410c1865fdc8399c283af3bbfbddfd4f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: 85da31a80a4d9abbb63b08026620b12410c1865fdc8399c283af3bbfbddfd4f6
SHA1 hash: e6f6408c7b75c0434569375b4893f98eab1167e9
MD5 hash: f415bb90f50b609f1d477e066b6b8d93
File name:Invoice DFC-6546735_pdf.exe
Download: download sample
Signature GuLoader
File size:180'224 bytes
First seen:2020-05-23 11:50:08 UTC
Last seen:2020-05-23 13:13:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 89dc71b70aaaba08e2e4c1a7b5ac83ed
ssdeep 768:An+UZv8p31bkgk5wLuk+BKW+lsmThZ71jaCtNhwI/3ziPcHmFDWuwhXLZay:q+s6bkgowLu+W+lsmThzaQ33DQDWuAYy
TLSH 5D04832BB50DCBADE7148EB2F57042F0157AAF6BE895192BF9C5FE2C347114C26012E6
Reporter @abuse_ch
Tags:exe GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: smtpout37.sweb.ru
Sending IP: 77.222.41.66
From: Andrea Perry <sales@mogindustries.tech>
Reply-To: sales@mogindustries.tech
Subject: Re:Overdue Invoice DFC-6546735
Attachment: Invoice DFC-6546735_pdf.img (contains "Invoice DFC-6546735_pdf.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1w-k0OqNANbahCjQzopaGUIFRUsC1kHMN

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 23
Origin country US US
ClamAV SecuriteInfo.com.Variant.Ursu.791968.4656.20149.UNOFFICIAL
VirusTotal:Virustotal results 34.25%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 85da31a80a4d9abbb63b08026620b12410c1865fdc8399c283af3bbfbddfd4f6

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments