MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 881397081db32078d4ceb1d900d1188f01602eb739996e3bba3c91f8056d3d13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 881397081db32078d4ceb1d900d1188f01602eb739996e3bba3c91f8056d3d13
SHA3-384 hash: 0f79dd81dc8cfb4c4dac74355d2d5afea75537b54d2f5d5acb751e3974fcc1875bd1eb37724747d9ee81c47e6e0ef392
SHA1 hash: ac8c25c1161912e8f21a21635671ebdd31328837
MD5 hash: 4fc7e5b54fa37da84e0ea8c5c1b9fabc
humanhash: west-don-august-oven
File name:FACTURA.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:42'974 bytes
First seen:2021-10-04 13:07:36 UTC
Last seen:2021-10-06 06:28:10 UTC
File type: rar
MIME type:application/x-rar
ssdeep 768:ZVYnFiCuEiHtDdyY8u0oB+OyGlG/1NEkprKfoRjlUAJMRDyNow:wnFDDiH1dyiB+OyGnWrugxBGRDc
TLSH T15513F2C805247EE4EFEF41F14B160927EA1C9A3BDF3B521A580C7CEBB665A0B9069C15
Reporter cocaman
Tags:GuLoader rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Bankia Caixabank <bankia_caixabank@bankia.com>" (likely spoofed)
Received: "from mail.s111228.furanet.com (mail.s111228.furanet.com [91.192.111.228]) "
Date: "Tue, 05 Oct 2021 00:28:57 -0700"
Subject: "FACTURA"
Attachment: "FACTURA.rar"

Intelligence

File Origin
# of uploads :
3
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/615c0fd698a6280f39324d63/reports/e05ff704-94bf-46fe-9b73-500a7b0f002e/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/881397081db32078d4ceb1d900d1188f01602eb739996e3bba3c91f8056d3d13/
Threat name:
Win32.Trojan.Mucc
Create hunting rule
Status:
Malicious
First seen:
2021-10-04 13:08:06 UTC
AV detection:
3 of 45 (6.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rajzoca5wmqhrvgowhmqbuiyr4awalvxhgmw4o52hsi7qblnhujq._file
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader downloader
Link:
https://tria.ge/reports/211004-qc8hvsgcg6/
Behaviour
Suspicious use of SetWindowsHookEx
Guloader,Cloudeye
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/881397081db32078d4ceb1d900d1188f01602eb739996e3bba3c91f8056d3d13

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 881397081db32078d4ceb1d900d1188f01602eb739996e3bba3c91f8056d3d13

(this sample)

GuLoader

Executable exe 94562bb510c9af666f0424ed8aa1767d17d18b79e8fad585b8d5857ec0eb4fb5

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 94562bb510c9af666f0424ed8aa1767d17d18b79e8fad585b8d5857ec0eb4fb5
  
Dropping
GuLoader

Comments