MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b69ab443253fa64871a80948b2828e1ec761393d3f754df6e02712636444c3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b69ab443253fa64871a80948b2828e1ec761393d3f754df6e02712636444c3a
SHA3-384 hash: 964a1df83eaa1c228f920f332e84c1e70dd9f930a17a5ade0b2e28f0d672429b2b0f18db8f5298ab3862035dc7e66e43
SHA1 hash: 449fb3e0152e64759ea1f035e036dd5c9dc0650c
MD5 hash: e5590a6e44bfefc673a48d939519ab16
humanhash: west-twenty-quebec-enemy
File name:PO.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-28 07:35:02 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:tCJMWW4JxidAuK51+SQNdO9Z/p6Fy15fnLOZabItaMCCcdEbgB3xUCWBz8voJaG:QJMWW4nEAuK7fQNdO9hp6F6duCCnclM
TLSH 25454B36BB5ACC72DA404CB0ECD1C5F81561BC11D8078A6B76C87F2F777A093AD6522A
Reporter abuse_ch
Tags:GuLoader img Outlook


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: EUR05-DB8-obe.outbound.protection.outlook.com
Sending IP: 40.92.89.93
From: Eric Quispe Ruiz <denis_quispe2@hotmail.com>
Subject: =?ks_c_5601-1987?B?seSx3sGmwNvAx7fa?=
Attachment: PO.IMG (contains "GM20200528.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1tq6uQ6hcpE5i_pS9c1DqTAJvs69X_1tI

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Noon-7585277-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 08:35:02 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 8b69ab443253fa64871a80948b2828e1ec761393d3f754df6e02712636444c3a

(this sample)

GuLoader

Executable exe 2eea12d417bbdbd859dc38307e5dfa3e90720865c81bc8ff99af0916d65e1a03

  
URLhaus
https://urlhaus.abuse.ch/url/370306/
  
Dropping
MD5 f315e618be659eb287be79a646bf1c45
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2eea12d417bbdbd859dc38307e5dfa3e90720865c81bc8ff99af0916d65e1a03

Comments