MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86c2895e3eaa2f058df03becfc997158aa791a249482f748fc424af137268cfd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86c2895e3eaa2f058df03becfc997158aa791a249482f748fc424af137268cfd
SHA3-384 hash: 575a9c601280a88c4ff20976cee5affa855df0c515a11b7be988bb10dfccd5f004f16a38e48e6aab295df82bfdf2fa20
SHA1 hash: 291bcc7fb36129ae795f2885baeb1d9709ea2d45
MD5 hash: a933cb43845713154c56c2c59ee0de16
humanhash: crazy-undress-fillet-ink
File name:WIRE REFERENCE.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-27 18:25:30 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:bf4RvVSJx3MqGNkK+gvP7+bNPb5KBBkm36brqz0+f90N85gV:YvMINMO+5bOlIWzNfaKgV
TLSH 0C457306BED5AC7DD15A2EF15884A9962A162C00BF0413EF31D8BB7D73368E16C71B1E
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: slot0.boellhof.com
Sending IP: 45.95.169.21
From: karla Friede <karla.friede@nvoicepay.com>
Subject: WIRE REFERENCE FOR NVOICEPAY PAYMENT #4321453
Attachment: WIRE REFERENCE.IMG (contains "WIRE REFERENCE.exe")

GuLoader payload URL:
http://185.205.209.166/wext/Rem-Stub23_tkxlq56.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.PonyStealer.jm0@FaDQe1ni.3864.2169.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 18:37:30 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 86c2895e3eaa2f058df03becfc997158aa791a249482f748fc424af137268cfd

(this sample)

GuLoader

Executable exe 60201a00a9f96b8efea761e31e3483a7a5bfd04ad66f766b3dd7b24e00664069

  
URLhaus
https://urlhaus.abuse.ch/url/369580/
  
Dropping
MD5 d29fd66f1d89911686bf374e7d755da2
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 60201a00a9f96b8efea761e31e3483a7a5bfd04ad66f766b3dd7b24e00664069

Comments