MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94ea164a308d46dca9373b22e2c816f5026a655cc051df5f09dc038f18efe854. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94ea164a308d46dca9373b22e2c816f5026a655cc051df5f09dc038f18efe854
SHA3-384 hash: bef3a50399341cbf4b92805f58474e2dcdca3090b48dc342c2f89493af1c9698ca2c30cb8a992f8cd30c62b2b1239186
SHA1 hash: 69cc065e72bddf7c5124bb92081e5f15a702e12a
MD5 hash: 8256c7e298b46990a4aa58dcf742aefa
humanhash: angel-foxtrot-equal-batman
File name:NIDEX LTD QUOTATION_2020.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:21'756 bytes
First seen:2020-06-08 12:10:26 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 384:sJspJ13agBwF1KnVPNnlviwAWW4NUN51iBWBDuggLRCzoNrofAewKP6KfVlNnSzA:wspJ13DBKIVPjqrN50BWZumzo1ofAXK7
TLSH DBA2CF928EA5486B2B66E07B3A47DC497FBD20F0CD94F9CA6127002DC942E5B4DDA1F4
Reporter abuse_ch
Tags:BGR geo GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: clean108.mxserver.ro
Sending IP: 89.46.7.164
From: NIDEX LTD <store@nidex.net>
Subject: Необходима е спешна оферта
Attachment: NIDEX LTD QUOTATION_2020.gz (contains "NIDEX LTD QUOTATION_2020.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1dh61IWa7fEtgrnP8A53Q04fHssd8qOWY

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Cerberus.12106.11230.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 12:12:05 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=stvbmsrqrvdnzkjxhmrofsaw6ubguzk4ybi56xyj3qby6ghp5bka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 94ea164a308d46dca9373b22e2c816f5026a655cc051df5f09dc038f18efe854

(this sample)

GuLoader

Executable exe 33b22f183b47d03a90eab7eda3ecc8f05c5e5b6e011588998d1b9aae4ead0f36

  
URLhaus
https://urlhaus.abuse.ch/url/383112/
  
Dropping
MD5 dfe34d84a84eff1c4ee158871025de3b
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 33b22f183b47d03a90eab7eda3ecc8f05c5e5b6e011588998d1b9aae4ead0f36

Comments