MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a64d73a346ecc2fae2b2d0c4a437a004bdb91291b2c724d106e209f6d386cb7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a64d73a346ecc2fae2b2d0c4a437a004bdb91291b2c724d106e209f6d386cb7e
SHA3-384 hash: e58b1cf880e466f6d9d6baa8cdf879a85dcfedd5c92ae33e27dc6ffdaffc477ebd3555f5adbe0891a039b8db329b867d
SHA1 hash: e94c52e23e25649e18cfb0b43a3e4579d78fabcb
MD5 hash: a04d462af27935c65068b7327f4ae2a8
humanhash: oven-kitten-april-xray
File name:Shipment Details 10-06-2020·pdf
Download: download sample
Signature GuLoader
Create hunting rule
File size:34'261 bytes
First seen:2020-06-10 12:35:52 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:EEij70h31kLrI2wGUIje/YZgvJULWo1A4ZK:ECl1kXVUIuYKJULZK
TLSH CFF2F168EFB706316058962D10FD94AF2D93B058048A4BEBB1E0F105DBA99B74ED8D4B
Reporter abuse_ch
Tags:geo GuLoader Shipment Details 10-06-2020·pdf TNT TUR


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: zeus.webex.gr
Sending IP: 46.4.69.158
From: TNT Shipment Notification (Turkey) <shipment@mail.tnt.com>
Subject: No.156902370 için TNT sevkiyat bildirimi
Attachment: Shipment Details 10-06-2020·pdf (contains "Shipment Details 10-06-2020·pdf.exe")

GuLoader payload URL:
http://bijelizec.hr/download/IFENAYE%20MAIN_sJNduT147.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27245.ZipHeur.HideExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 12:37:08 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uzgxhi2g5tbpvyvs2dckin5aas63seurwldsjuig4ie7nu4gzn7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip a64d73a346ecc2fae2b2d0c4a437a004bdb91291b2c724d106e209f6d386cb7e

(this sample)

GuLoader

Executable exe f0f07c2192956e44619a5bea6c55b3f2d4be7ad9fd86fa1e85f734deaacc05f6

  
Dropping
MD5 299830c47b000b9aaeacc7ba7de98173
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f0f07c2192956e44619a5bea6c55b3f2d4be7ad9fd86fa1e85f734deaacc05f6

Comments