MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6b50ea50dbf99fa3cb6e56390dbc517b29c7d6b3c98b76a2ddc7b05092744b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6b50ea50dbf99fa3cb6e56390dbc517b29c7d6b3c98b76a2ddc7b05092744b3
SHA3-384 hash: 98374b001f86c235e9acf11bbb9a151f135405db200ce8eb3fdef336c5db4ba7e9e31c1a435714d66234b55383ebd7eb
SHA1 hash: c1892facdd980e7618cc6dfdcdfc763a52cddc4a
MD5 hash: d35540eff5bd08b2cc6228205924e594
humanhash: jersey-muppet-failed-green
File name:Order1026046.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:86'163 bytes
First seen:2020-06-04 15:55:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:5w5AoqvqG9/G0mnDrR80rcFiLoLHHJA0Vl4mbOsPEQY5o:iA/WnEgLojJpl5DPEp5o
TLSH 41831213169EA364B400F08115BF627DBCF6867278FFF81A271397456F9D4D808AB239
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: 152.120.trunkoz.com
Sending IP: 23.226.120.152
From: Sales <beast3x@theautomotivevehicle.com>
Subject: New Order (top urgent)
Attachment: Order1026046.zip (contains "Order1026046.exe")

GuLoader payload URL:
http://legalpros.lawyer/ghv/biggrc_qoSWPEbxr197.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 16:36:50 UTC
AV detection:
13 of 31 (41.94%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u22q5jinx6m7upfw4vrzbw6fc6zjy7llhsmlo2rn3r5qkcjhiszq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip a6b50ea50dbf99fa3cb6e56390dbc517b29c7d6b3c98b76a2ddc7b05092744b3

(this sample)

GuLoader

Executable exe 1c3b6c661cd142c98ccc346a878878141b33361c7db6176c5bedfea72e1a59e3

  
URLhaus
https://urlhaus.abuse.ch/url/379330/
  
Dropping
MD5 35369e0c6d007c5f488cfbb8be20aaae
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1c3b6c661cd142c98ccc346a878878141b33361c7db6176c5bedfea72e1a59e3

Comments