MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9620e9e95846fd7b21206464f6e5493290e869a425887621835ecc2a0de82101. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 3 Yara Comments

SHA256 hash: 9620e9e95846fd7b21206464f6e5493290e869a425887621835ecc2a0de82101
SHA1 hash: 9e4a42e803d85d178478897ff757ab8a8aa5921e
MD5 hash: aaf0f0e6deb5b6a3f8ebf8c98ffe08d5
File name:20200522_wj3.exe
Download: download sample
Signature GuLoader
File size:102'400 bytes
First seen:2020-05-22 09:54:53 UTC
Last seen:2020-05-22 10:52:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4ba69cb43ef921d63e89dc182626b1a7
ssdeep 768:VOC0wu7eg3eGbZJwaAfMrWjUOn0le9mlVCEY8pwG0CNClil729NG5ncvx:wjwiuwZSDJAe9VEY8p0CNj72H/p
TLSH D9A30935F5E0EE42CA4D49F11E276B291817FCB519990AC3A2C77B1C39325C2AA7136F
Reporter @abuse_ch
Tags:exe geo GuLoader KOR


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm37.hanmail.net
Sending IP: 203.133.180.225
From: 이용종 <ogd7528@hanmail.net>
Subject: 첨부도면 견적요청 드립니다.(한석이엔지 입니다.)
Attachment: file.xls.img (contains "20200522_wj3.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1Bj4Pk98k6226AN6WvT5V8g8bLwo9zUcc

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 26
Origin country US US
ClamAV PUA.Win.Packer.ProtectSharewar-2
PUA.Win.Packer.ProtectSharewar-3
VirusTotal:Virustotal results 32.39%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 9620e9e95846fd7b21206464f6e5493290e869a425887621835ecc2a0de82101

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments