MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c4932e3b30ec57ea574dd96226fc9bff7327b3d78a2e52d11d7b47619348e3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8c4932e3b30ec57ea574dd96226fc9bff7327b3d78a2e52d11d7b47619348e3d
SHA3-384 hash: 583b2b8392bdd13fedfdb89ae5b66d59d65e3f701aa1fc3d316f9726b741291433ddc3c4b2919ab56e4ac6715e47b660
SHA1 hash: 156f001536515b71f53d9eac57989e459638d3b7
MD5 hash: b09eb54dee18e6d9145bcb13b781e26f
humanhash: batman-october-monkey-nevada
File name:RFQ-PR20211201.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:29'183 bytes
First seen:2021-01-12 07:24:12 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 768:N2v52uu0XFk2ZIu8YSPq1wlwX3CdsA0fHGf:qxbZIAt1iACdsA0s
TLSH B6D2E14FB70FB8704AAFE66472A257E70AF0984D34E6D888D2415C9FE4DD190E69CC9C
Reporter abuse_ch
Tags:arj GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: cceechina.com
Sending IP: 222.128.44.226
From: KH Wong<clc@cceechina.com>
Reply-To: <seema@cosnas.in>
Subject: URGENT RFQ-PR#20211201
Attachment: RFQ-PR20211201.arj (contains "RFQ-PR#20211201.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=5D459187D4C37C0C&resid=5D459187D4C37C0C%21108&authkey=ACn5the3goJioQ0

Intelligence

File Origin
# of uploads :
1
# of downloads :
204
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8c4932e3b30ec57ea574dd96226fc9bff7327b3d78a2e52d11d7b47619348e3d/
Threat name:
Win32.Infostealer.PonyStealer
Create hunting rule
Status:
Malicious
First seen:
2021-01-12 07:24:22 UTC
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rretfy5tb3cx5jlu3wlce36jx73te6z5pcroklir262hmgjury6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8c4932e3b30ec57ea574dd96226fc9bff7327b3d78a2e52d11d7b47619348e3d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

arj 8c4932e3b30ec57ea574dd96226fc9bff7327b3d78a2e52d11d7b47619348e3d

(this sample)

GuLoader

Executable exe 1c9344d3993bafbe60739644d0fae336276c4ffd835da89d44b58ef4d744eee0

  
URLhaus
https://urlhaus.abuse.ch/url/954600/
  
Dropping
MD5 7f460fbf235c5e678b553edd2113d890
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1c9344d3993bafbe60739644d0fae336276c4ffd835da89d44b58ef4d744eee0

Comments