MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 918090d6fc0149a468d638347c71380eda93f95752a68363f31383210c1cd106. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 918090d6fc0149a468d638347c71380eda93f95752a68363f31383210c1cd106
SHA3-384 hash: 284599d3bddf55fb5b4a89dfb19359e29550d2bfff35b6504a26b0433d1ebc189938372c6c8490ee62e08d82df982863
SHA1 hash: d219beef547fa0f55cd978cadd36d86e9290c07b
MD5 hash: a66f5aae13e49d78ae5e59be4b52dff9
humanhash: five-michigan-whiskey-maryland
File name:Specification#300_05-02-2021.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:233'472 bytes
First seen:2021-05-04 04:59:34 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:TV2p+voOGIhkbIVb2ayvnF7lJswgtzz2i63kmA7Gw4mDAI16luJ17hH0SPtnw2i6:TbvozICHDvBJkzz25aPzAcHj9w2
TLSH CC34F7326E04949EE9AD2670A415C936F3162C1471092E5F7EA1FFB137F2A836DF5E02
Reporter cocaman
Tags:GuLoader img


Avatar
cocaman
Malicious email (T1566.001)
From: "=?UTF-8?B?TmF2ZWVkIEt2xJt0b3NsYXZh?= <petr.samanek@cvut.cz>" (likely spoofed)
Received: "from cvut.cz (unknown [84.38.134.39]) "
Date: "04 May 2021 04:21:51 +0300"
Subject: "New order,"
Attachment: "Specification#300_05-02-2021.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
175
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Porcupine.Unclassified.100383.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/918090d6fc0149a468d638347c71380eda93f95752a68363f31383210c1cd106/
Threat name:
Win32.Downloader.Minix
Create hunting rule
Status:
Malicious
First seen:
2021-05-03 19:15:17 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
6 of 28 (21.43%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sgajbvx4afe2i2gwha2hy4jyb3njh6kxkktigy7tcobscda42eda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/918090d6fc0149a468d638347c71380eda93f95752a68363f31383210c1cd106

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 918090d6fc0149a468d638347c71380eda93f95752a68363f31383210c1cd106

(this sample)

GuLoader

Executable exe 184676b18d687073308c791c9145f0b0c8bc6a75fd4ed7aff7803381701c06f0

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 184676b18d687073308c791c9145f0b0c8bc6a75fd4ed7aff7803381701c06f0
  
Dropping
GuLoader

Comments