MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c2e8914a4d3511eaa2f69e6ab33c9ff7d760d4ebfb761b38ed56eed8fe32ddb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c2e8914a4d3511eaa2f69e6ab33c9ff7d760d4ebfb761b38ed56eed8fe32ddb
SHA3-384 hash: a3ba784f28e8b6c7907e72d70af0e434414fe21a7fd2d0d1cd2d1d8eb491e280d0b60d1d410b6d2c20fb58cb5e8e3ce2
SHA1 hash: 610404556a9095f8e7e95a211e3582a383944d62
MD5 hash: fa7d5cc0368a3c68397b1f86dc9d3ac4
humanhash: blossom-one-montana-fanta
File name:Requestion For Quotation.pif
Download: download sample
Signature GuLoader
Create hunting rule
File size:86'016 bytes
First seen:2020-05-03 12:36:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d9de1882c063777e0de1fded5f91e014 (1 x GuLoader)
ssdeep 1536:AMaEJrARRX0A+AymLRFs5vQ66uGZxUx2:AMLvZ5vQ6s7/
Threatray 715 similar samples on MalwareBazaar
TLSH 53837D16F1D9E836CC608AF5AA1FD3A81067FD3119158F0774843FAE5A33E01D9913AB
Reporter abuse_ch
Tags:GuLoader pif RAT RemcosRAT


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server240-2.web-hosting.com
Sending IP: 199.188.200.16
From: GM CEO<info@attachmentusercontent.com>
Reply-To: infoa6044@gmail.com
Subject: General Manager CEO Request For Quotation
Attachment: Requestion For Quotation.zip (contains "Requestion For Quotation.pif")

GuLoader pushing RemcosRAT

RemcosRAT payload URL:
https://mail-cloud.ngrok.io/bin/pounds-hopto_ngcXGkDrVs1.bin

RemcosRAT C2:
pounds.hopto.org:9115 (155.94.198.169)

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-03 11:54:24 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tqxisffe2nir5krpnhtkwm6j756xmdkox63wdm4o2vxo3d7dfxnq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
52aeea8a255442f1560a6c237fb9c6d5223e7de9eb3340d29f81803df963ee8a
GuLoader
79a2240a25ae035c8fb372974e643f276099d86118d018bb6053571cc3d06ce8
GuLoader
855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3
GuLoader
8869b2576e5e5ebd15edee49935a89a27bb6dee506483a27f805f708d4bf8957
GuLoader
b7f3b8c8e8cd3b886baea02961ce6968315359a78e4af1edc51f930ae4ebd67b
GuLoader
cb530981e6d92b89bc5346c11b478a5fb329eae8d8bb4609ee00f64747b993ff
GuLoader
d18ed67b05d0bbd6dfaba77a6053c92674bfef8abc8c7aae7c17f703adc6ea5c
GuLoader
d725785ec3970b75ecb17a7e5ac14d93ce7a54d259dffc74e8222ed8cfb8b6b3
GuLoader
da40229062dc045460d3adcd70e42d15378ec4a83fd93738b30a59f5fab8da10
GuLoader
dfe54696ad7c10bc44e524a6d292f94a951bd29aa1f4dbee29b6ae56eaf9fa51
GuLoader
+ 705 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip ec904b879d1d21ef741b6bb6ac6a557fcc75f6a10a49a8af9b70c9ae57b9b928

GuLoader

Executable exe 9c2e8914a4d3511eaa2f69e6ab33c9ff7d760d4ebfb761b38ed56eed8fe32ddb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/356529/
  
Dropped by
MD5 ff70ec175dd562353bf2a425700dc470
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 ec904b879d1d21ef741b6bb6ac6a557fcc75f6a10a49a8af9b70c9ae57b9b928

Comments