MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c7b06a8416498500f40edce778e4fccdf2a2e52e02a54693b9996252928ec70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8c7b06a8416498500f40edce778e4fccdf2a2e52e02a54693b9996252928ec70
SHA3-384 hash: ec18b358fcfe7fa1c8fcce3a752efb5549b2198fc712b25f251e69e096445b400a7a6cc19f1b7e653213ff8cd7df6ab4
SHA1 hash: 6add661c47794e5389d2ca8861c12f71d7d79087
MD5 hash: 4391bbe5a9b8ed48b43bf77a1e68f6b1
humanhash: purple-black-low-mirror
File name:Covid-19 hojas de especificaciones.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:26'209 bytes
First seen:2020-04-13 17:52:00 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 384:KGeicOYAUBOpDp3Ztij7xujgptb6xaG4DLq6RKwtazhTSVbaKkgYbJJSYn:pYAgetA1ujgptb6Mo0Oh6OK6Z
TLSH 77C2E196B9DBC284D7803744F48196BF75821548FC8323771FACA2C1D7EB91A91D26F1
Reporter abuse_ch
Tags:arj COVID-19 GuLoader


Avatar
abuse_ch
COVID-19 themed malspam distributing GuLoader->AgentTesla:

HELO: srv3.hostingafull.com
Sending IP: 198.46.134.157
From: shyam.m@sevenpharma.net
Subject: Productos COVID-19 (Coronavirus)
Attachment: Covid-19 hojas de especificaciones.arj (contains "Covid-19 (hojas de especificaciones).bat")

GuLoader payload URL (AgentTesla):
https://drive.google.com/uc?export=download&id=1cnKgO1WC_XGRP2u0VspZs1LTWO_DvI_U

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Fareitvb
Create hunting rule
Status:
Malicious
First seen:
2020-04-13 18:35:27 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
14 of 45 (31.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rr5qnkcbmsmfad2a5xhhpdspztpsulss4avfi2j3tglckkji5rya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

arj 8c7b06a8416498500f40edce778e4fccdf2a2e52e02a54693b9996252928ec70

(this sample)

GuLoader

Executable exe 1c7aee0fc8ced2b774aa4a05c4a00228dddb3c9768afa1f8309f8e188431836d

  
URLhaus
https://urlhaus.abuse.ch/url/339625/
  
Dropping
MD5 ccf85d80bf9de861ae1deb60e7bd6294
  
Dropping
SHA256 1c7aee0fc8ced2b774aa4a05c4a00228dddb3c9768afa1f8309f8e188431836d
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment

Comments