MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e73787d3dc6bb435522fee22cb9d32fa7a02b12975f8e3eefe95a67f2b122d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e73787d3dc6bb435522fee22cb9d32fa7a02b12975f8e3eefe95a67f2b122d8
SHA3-384 hash: 5ac57500e9977538c149fc6ca683c35e59f3900d0029bb32deb12da8b8ca358a48e45eeaf37ea2ae6cf630d0ba62d174
SHA1 hash: 0983ff304df8e404524ad077ccff37b8d87d6850
MD5 hash: 7044556982e3b692c6b72c7c4ca7decb
humanhash: xray-alanine-fish-mango
File name:Health-E-Book·pdf.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:26'041 bytes
First seen:2020-03-30 10:15:57 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:Te4v4a487m/hIvqFPYa9AJB/Z1EDlY0b0AGecrip/AA1kScsRw+T:DvvS/0q+T51EDxpbnp/KScuN
TLSH 40C2E18650F45ACBF2F4E9EF494C85217105679DE64028C4D42DAFE60E3EDAA61B079C
Reporter abuse_ch
Tags:COVID-19 GuLoader zip


Avatar
abuse_ch
COVID-19 themed malspam campaign distributing GuLoader->AveMariaRAT:

HELO: server.yafuzsport.com
Sending IP: 148.251.119.5
From: WHO: World Health Organization <who_advise@who.int>
Subject: Alerting Consumers
Attachment: Health-E-Book·pdf.zip (contains "Health-E-Book·pdf.exe")

GuLoader payload URL (AveMariaRAT):
https://drive.google.com/uc?export=download&id=1boC4iE-cB85KxGFqXp7XyEv8UYq-2Y0C

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.VBGeneric-7644607-0
Create hunting rule

Win.Dropper.Remcos-7647550-0
Create hunting rule

Win.Trojan.Ponystealer-7648176-0
Create hunting rule

Win.Dropper.Remcos-7683428-0
Create hunting rule

Sanesecurity.Malware.27245.ZipHeur.HideExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Jaik
Create hunting rule
Status:
Malicious
First seen:
2020-03-30 10:18:47 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
16 of 30 (53.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rzzxq7j5y25ugvjc73rczootf6t2akyss5py4pxp5fngp4vrelma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 8e73787d3dc6bb435522fee22cb9d32fa7a02b12975f8e3eefe95a67f2b122d8

(this sample)

AveMariaRAT

Executable exe 0d38ea72059443a96e979d8669d1eb95be5863beb8459ef4d408417c3e823484

GuLoader

Executable exe c86adaa9802afda5346e7b351ebe646dcf3bdeff37af3beb9f72b2bf42d2b5e2

  
URLhaus
https://urlhaus.abuse.ch/url/332084/
  
Dropping
MD5 e11c962c564678430583982c79947a99
  
Dropping
SHA256 c86adaa9802afda5346e7b351ebe646dcf3bdeff37af3beb9f72b2bf42d2b5e2
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c86adaa9802afda5346e7b351ebe646dcf3bdeff37af3beb9f72b2bf42d2b5e2

Comments