MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96365ab8e95d8ef02e2653fff5e26f6bc0d4eff1928ce655b2f3a15d2f867c4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96365ab8e95d8ef02e2653fff5e26f6bc0d4eff1928ce655b2f3a15d2f867c4e
SHA3-384 hash: 82fb40989ffdfcdba34a9c8450baed09f2374bf23f57e87bbf50e9a0ef778384c75f880c83ad58051c54344268597ed7
SHA1 hash: 86eabc3fd068849fada45a76bef98cdac6be09cf
MD5 hash: c18dcd5ef860dff2c864c0e08358bc19
humanhash: mexico-quiet-oregon-chicken
File name:New order.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:31'277 bytes
First seen:2020-05-26 09:04:14 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 768:bA3bsr6DMs91Ih6fdWG26vmUzeuDBBDtJopL73/hJwHG7fF8XbGok:s7geWop2yC+Xop/3/hqmM5k
TLSH 84E2F1B7299506963AAF3C1FA853ED6587C0D872654EDFDAC0B6E4E133D597103C0702
Reporter abuse_ch
Tags:arj GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: nugraha.pw
Sending IP: 198.148.118.237
From: Trading co., ltd <iinfo@nugraha.pw>
Subject: New order
Attachment: New order.arj (contains "New order.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1P1M7W_C3TTCYYcrFusgaexmopta3xcgv

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 09:37:07 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

arj 96365ab8e95d8ef02e2653fff5e26f6bc0d4eff1928ce655b2f3a15d2f867c4e

(this sample)

GuLoader

Executable exe 49b83750fc8ffbfd1a1e0c11be6eb327159fdeb0e8c20820844fd3af2d96c2f2

  
URLhaus
https://urlhaus.abuse.ch/url/368737/
  
Dropping
MD5 e124c5f22e09d61cad377493edcec0df
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 49b83750fc8ffbfd1a1e0c11be6eb327159fdeb0e8c20820844fd3af2d96c2f2

Comments