MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88b879c29b0717f7ec44dae0194e5d25d64bde5f5826e4490c9344778b2cd275. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88b879c29b0717f7ec44dae0194e5d25d64bde5f5826e4490c9344778b2cd275
SHA3-384 hash: 65d8336b1d354801e46adeacb1eddab1c13f279e08b8ac7776ce77beae4267d99f898685e0e182d2bb3e313cd8743907
SHA1 hash: 8ed01222542d6d2ee8f261cff0def7a62fa8702e
MD5 hash: 98264971dced8d2adcabc93300d9e788
humanhash: winter-rugby-south-paris
File name:Facturas Pagadas al Vencimiento.r00
Download: download sample
Signature GuLoader
Create hunting rule
File size:86'071 bytes
First seen:2020-06-04 15:55:22 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 1536:riH9ci8cZz9HD9zqrKZbeD4UaoHu96o2vGnSN5cEaCb:riH9RrZ9HDlEKZiD4Uaou67GnSfche
TLSH B18302F7448359BF648F899A64CFD20CAFB19468855E9F32AF3B5D4CB050DE613C2A24
Reporter abuse_ch
Tags:BBVA ESP geo GuLoader r00


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail.s070039.furanet.com
Sending IP: 77.81.116.28
From: Confirming.bbva@bbva.com
Subject: BBVA-Confirming Facturas Pagadas al Vencimiento
Attachment: Facturas Pagadas al Vencimiento.r00 (contains "Facturas Pagadas al Vencimiento.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1m4oEl1RGYzCbX6iSmin_37IGBN6S67HL

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 16:36:41 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rc4htqu3a4l7p3ce3lqbsts5exlexxs7latoisimsnchpczm2j2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

r00 88b879c29b0717f7ec44dae0194e5d25d64bde5f5826e4490c9344778b2cd275

(this sample)

GuLoader

Executable exe e0d379ff05529ef018085ddb03216e3d5d89609a4a5f306f02ffaf8e08712d36

  
URLhaus
https://urlhaus.abuse.ch/url/379337/
  
Dropping
MD5 32d373a72526e5276b68a5c2812be670
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e0d379ff05529ef018085ddb03216e3d5d89609a4a5f306f02ffaf8e08712d36

Comments