MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a57304043cdf4e54783b99ba437e2dedc5bded49da0878e17c459ba37e41bb55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: a57304043cdf4e54783b99ba437e2dedc5bded49da0878e17c459ba37e41bb55
SHA1 hash: d448f4d37d956b6cff94b138052ae82e9b88b1ca
MD5 hash: 349102943dad118d0581c3f5e253e9d9
File name:DOC22052020.exe
Download: download sample
Signature GuLoader
File size:94'208 bytes
First seen:2020-05-22 10:03:02 UTC
Last seen:2020-05-22 10:52:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9e3640e71786502ec4d9e27f3161fb10
ssdeep 768:T8/n28tp5VJruvkuaYQ8NLK1RAXc5jHMZcNR7vF6TM05uVCcpyVrolZHhyws1:Q5pfJavkT8/4jsZm65co2ZHhyF
TLSH D3933B2A7A54F9E6C9204FF11D32CAD40667BD3119520B077FCA7F6D2C32A4E9929393
Reporter @abuse_ch
Tags:exe GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: poc.creationfinancial.co.uk
Sending IP: 178.62.94.186
From: pablo <info@100gbit-ethernet.net>
Reply-To: kodak3399@protonmail.com
Subject: RE: 02-REQUEST FOR - STOCK
Attachment: DOC22052020.img (contains "DOC22052020.exe")

GuLoader payload URL:
https://noirrealtysolution.com//are/bin_bwocAPbwD126.bin

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 26
Origin country US US
ClamAV PUA.Win.Packer.ProtectSharewar-2
PUA.Win.Packer.ProtectSharewar-3
VirusTotal:Virustotal results 13.70%
ReversingLabs :No data

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe a57304043cdf4e54783b99ba437e2dedc5bded49da0878e17c459ba37e41bb55

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments