MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9dfcc0a2fb77ba355966c2526a919ad44ef889441ddb09c80b6a1c38e0e28724. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9dfcc0a2fb77ba355966c2526a919ad44ef889441ddb09c80b6a1c38e0e28724
SHA3-384 hash: e28ea22df167f4b628d83b4d3a6df992529030bc95719b34a1c8959c9a41f0b908c92f7787c86ea753e66bfaa4814aba
SHA1 hash: cf29e8897b309ab92930d208cd6ef99b42f2615d
MD5 hash: 751718dce33dee43a2c773e856771bd2
humanhash: ack-bravo-london-two
File name:AWB _ARRIVAL DHL EXPRESS 3245888693.tbz2
Download: download sample
Signature GuLoader
Create hunting rule
File size:86'314 bytes
First seen:2020-06-04 15:55:37 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:IuXZkXolIx045deqtl10trMkhEsqwfO+nwr51KGQmCsHq1nYoyV17JfAq:IWyRe3FEsdO+nwV1KG/51lfP
TLSH 92831293542C51B262BBE87579C516D1030FA3E3AB45DAF1E4290E898EED45343BEF90
Reporter abuse_ch
Tags:DHL GuLoader tbz2


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mx2.aroelevenhost.com.br
Sending IP: 192.163.198.161
From: dhlemailship@dhl.com
Subject: DHL EXPRESS AWB 3245888693- Shipment Notification
Attachment: AWB _ARRIVAL DHL EXPRESS 3245888693.tbz2 (contains "AWB _DHL EXPRESS 3245888693.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1D6qGXWOrExPVmfqezQuXaOYUJcZXCVf_

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 16:36:49 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tx6mbix3o65dkwlgyjjgvem22rhprckedxnqtsalniodryhcq4sa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 9dfcc0a2fb77ba355966c2526a919ad44ef889441ddb09c80b6a1c38e0e28724

(this sample)

GuLoader

Executable exe 6b264d7bac7b64c40d89c0e35016ce95f78a90f4f098fc3c1116217c98fe544a

  
URLhaus
https://urlhaus.abuse.ch/url/379326/
  
Dropping
MD5 53db4de1c74137963ea8a8da4cfe02a2
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6b264d7bac7b64c40d89c0e35016ce95f78a90f4f098fc3c1116217c98fe544a

Comments