MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93817ca760a6635842d345527ec7a0b1b10549cdbeeca5a45ca1aa592790972f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93817ca760a6635842d345527ec7a0b1b10549cdbeeca5a45ca1aa592790972f
SHA3-384 hash: 29ac24d7d498b7ea8f334bc562ca5a3b5d0548eac18658abf23a30139fde6a028ca7043fccda162fa2f0d0a206eb8970
SHA1 hash: 3ef915aa526160fc59a8201d9f2db122e7b7bb9e
MD5 hash: 0c63d96889af1464e3442a954205cba0
humanhash: don-cup-india-alabama
File name:UPGROW.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:21'847 bytes
First seen:2020-06-02 11:22:10 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:c3g6obJHTqkcVHRyXw3MIgx9OzSQw6aHN/+Hw8FcSk9skgvyEXseuBpNW:c36JehRiwHmOzFVCCFcxqXsnjNW
TLSH BDA2E1B0020A1392765990CE51970DA2809DA9A77E79FE909C3DE87B37CBC16BCD169C
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: yuntong-batt.co
Sending IP: 111.90.141.203
From: Jeon, Choosang <Jeon@yuntong-batt.co>
Subject: RE: Order confirmation
Attachment: UPGROW.rar (contains "UPGROW.exe")

GuLoader payload URL:
http://111.90.148.217/MAZE_OqxnXAfR130.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 08:40:44 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=soaxzj3auzrvqqwtivjh5r5awgyqksonx3wkljc4ugvfsj4qs4xq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 93817ca760a6635842d345527ec7a0b1b10549cdbeeca5a45ca1aa592790972f

(this sample)

GuLoader

Executable exe d18ed67b05d0bbd6dfaba77a6053c92674bfef8abc8c7aae7c17f703adc6ea5c

  
URLhaus
https://urlhaus.abuse.ch/url/374151/
  
Dropping
MD5 49cb6fa7e773fc7bda7890576af7caa7
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d18ed67b05d0bbd6dfaba77a6053c92674bfef8abc8c7aae7c17f703adc6ea5c

Comments