MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ced0f9d7f87be318819f247ad8dfa5add123f60f5b3cf72736af44165d073f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ced0f9d7f87be318819f247ad8dfa5add123f60f5b3cf72736af44165d073f1
SHA3-384 hash: d5cbf623f575e91b0c42d345b11b3e2ed1e61a56932905e79a01ede7142f5281977c9112a0f7824cf42536d3c4336d6d
SHA1 hash: 9bad65219d9f753664d93a166238e437bbf44579
MD5 hash: a234d36b47b79f8f51208ebefbefd5cb
humanhash: mountain-one-johnny-nine
File name:Invoice.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:36'645 bytes
First seen:2020-03-17 09:41:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:xmpWJ5NFGHzD5ynCyQI0rTNOslWIn+pATTXfDLxF7kmbD:xm65NFGHBy5QIB/InnTXfD3zX
TLSH F6F2017DD80029E38C852F91A96447AFCDE43983F6FAF9FA5811514828C5D4F8F221DB
Reporter cocaman
Tags:GuLoader zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.45047.10817.11362.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25244.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21103.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.PonyStealer
Create hunting rule
Status:
Malicious
First seen:
2020-03-17 18:38:20 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
28 of 45 (62.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ttwq7hl7q67ddcaz6jd23dp2llorep3a6wz464ttnl2eczoqopyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9ced0f9d7f87be318819f247ad8dfa5add123f60f5b3cf72736af44165d073f1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 9ced0f9d7f87be318819f247ad8dfa5add123f60f5b3cf72736af44165d073f1

(this sample)

GuLoader

Executable exe b4faad2ab96b7348202784c23e871c07a7e5cc2ff7f0d83037cb26954f1bb8e3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b4faad2ab96b7348202784c23e871c07a7e5cc2ff7f0d83037cb26954f1bb8e3

Comments