MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4aa7436d6636585e10fe080b66c6b0c100fb1b2a740612ca317c357515290bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4aa7436d6636585e10fe080b66c6b0c100fb1b2a740612ca317c357515290bb
SHA3-384 hash: 32303fa8949ea5c036ebeef0c692005467e918b2a04b7ff214e50ee00190beb6ab0d449dcb513f820a7f5b7d52b33ac6
SHA1 hash: 13f31d5170be6465814f03a065d87c917fecc790
MD5 hash: 221003b1550fc40ab9de2e3a2a651509
humanhash: bluebird-diet-queen-arizona
File name:RFQ78019913.doc.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:26'782 bytes
First seen:2020-04-06 04:59:04 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:cKWP5KBfhqCLJUZfGlJLzdhMQnBy4gPb4dQ5YRmdFwcwjepsFHDSA+YOnqlLk2rl:o5KBfhJyIxz8QnBytiyFFAWsR9+qk2rl
TLSH 35C2E1CB4307EC89FBA77D3DB35C73B7E820A4656811F26F904E5039DA245E25A46236
Reporter cocaman
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Noon-7650558-0
Create hunting rule

Win.Dropper.Fareit-7650598-0
Create hunting rule

Win.Malware.Generic-7650850-0
Create hunting rule

Sanesecurity.Malware.25512.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Frs
Create hunting rule
Status:
Malicious
First seen:
2020-04-06 05:35:36 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
30 of 47 (63.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=usvhinwwmnsylyip4calm3dlbqia7mnsu5agclfdc7bvoukssc5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip a4aa7436d6636585e10fe080b66c6b0c100fb1b2a740612ca317c357515290bb

(this sample)

GuLoader

Executable exe 0603ab9e9dc5a76e493232f85c474f3a7e9eeaa937158916b7df9466dc01106f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0603ab9e9dc5a76e493232f85c474f3a7e9eeaa937158916b7df9466dc01106f

Comments