MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9afa32268f2a9c2727388e824bba6058da36885d44cedd92cc4ad0e347480dbb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9afa32268f2a9c2727388e824bba6058da36885d44cedd92cc4ad0e347480dbb
SHA3-384 hash: 9a059af828e06f38fbc2b2e1e602ff6ee97e48bd33abab61ac26ddd0ab84fc7a53e9404cd873e5135308620aaf64d861
SHA1 hash: 8908237d5ddac9bffda02f86f493d4b23e658fd1
MD5 hash: 4e52fc906f441dc1d3be52d821f1caa6
humanhash: jig-ten-yankee-aspen
File name:VP-XLPE-S007-LT-002_SPARE PART LIST.ISO
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-25 13:40:40 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 768:vEmfiMP1B0AHg8Shn0u6aRLM/3kuy26SVWXuD0W/sw7R38GbBYfKfHwbAH521M0R:VfFqUbsn0WCUuXzWU0QXbB5wbAZ2GBK
TLSH 0A45C603F6D8BC83E9054DB24EE5AAB50966BC791DA10B1BB09EB74E1B761C09FF0705
Reporter abuse_ch
Tags:GuLoader iso


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm48.hanmail.net
Sending IP: 203.133.180.236
From: 이한석 <hd3096@hanmail.net>
Subject: FW: [XPLE PJ] Project RFQ/ Spare parts list [예산견적]
Attachment: VP-XLPE-S007-LT-002_SPARE PART LIST.ISO (contains "VP-XLPE-S007-LT-002_SPARE PART LIST.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1FaIrcjvh13I-GykLsBIbuVk9NXRIJfyH

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 08:24:18 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso 9afa32268f2a9c2727388e824bba6058da36885d44cedd92cc4ad0e347480dbb

(this sample)

GuLoader

Executable exe 3c2fb53051873bdd9f851e47352dd4b303241a0224f458040dd5d06ac242cc7d

  
URLhaus
https://urlhaus.abuse.ch/url/367850/
  
Dropping
MD5 ddbf1930e4eb8569016a8104793bfc5a
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3c2fb53051873bdd9f851e47352dd4b303241a0224f458040dd5d06ac242cc7d

Comments