MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c3241e1bb45734e245ae7e36dd5145ff7fee1efc0d9550e6d5b7a8b0d1784fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c3241e1bb45734e245ae7e36dd5145ff7fee1efc0d9550e6d5b7a8b0d1784fe
SHA3-384 hash: 5e86a02223f34357524e555b2b897d47e36c59914be7c4f215c23ef5c03a51159d57af09637ae381ddfd6f40d569f862
SHA1 hash: 913e04d26b5c38e5abf9e8dc6f32ce4317ab3685
MD5 hash: 77748cb9fcc682d746406a03f20effe9
humanhash: sodium-michigan-finch-oregon
File name:Docusign #Inv00328 EFT payment invoice 04-30 pdf Statements.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:299'008 bytes
First seen:2020-05-01 15:53:51 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:bwrzobMfy99/Zi1exlznc7oiW1agTTQLyuuf/QYhqU4aNNzEHGN5NzutoihyE:XbJ99kIPznEFW1XTmuwYh33EmN5NyhP
TLSH 91543815FAE4E973D6508AF14F36D6E44067BC300D418E13BAAD7B2EAB36E02E550367
Reporter cocaman
Tags:GuLoader img


Avatar
cocaman
Malicious email
From: lgpartner.ch <accounts@aspecths.ml>
Received: from mta0.aspecths.ml (mta0.aspecths.ml [23.254.226.57])
Date: 01 May 2020 16:42:35 +0100
Subject: __Fwd: Re: EMAILADDRESS #Inv00328 Payment Delivered | #EFT Payment Invoice
Attachment: Docusign #Inv00328 EFT payment invoice 04-30 pdf Statements.img

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Win.Dropper.Genkryptik-7735947-0
Create hunting rule

Win.Trojan.VBGeneric-7736020-0
Create hunting rule

Win.Trojan.A4eyumdi-7736299-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 16:35:33 UTC
File Type:
Binary (Archive)
Extracted files:
21
AV detection:
13 of 31 (41.94%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tqzedyn3ivzu4jc247rw3viul7375yppydmvkdtnln5iwdixqt7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 9c3241e1bb45734e245ae7e36dd5145ff7fee1efc0d9550e6d5b7a8b0d1784fe

(this sample)

GuLoader

Executable exe 39931e1fb3b7e82ef1669505f39e9598c1620b8740ab59971bc6aeae0cd6082b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 39931e1fb3b7e82ef1669505f39e9598c1620b8740ab59971bc6aeae0cd6082b
  
Dropping
SHA256 4b9d879ea6b4ca40c087b7cbd0474590bbca1f1dc788cb7689a96bbf0a044d4b
  
Dropping
SHA256 2ace558d202e365fac33752bc28b1c60b07e90904c9f0f4492d13d67f3277530

Comments