MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6c9b8bb4fb07ba78a89f8267aee2d6bb5d815c0c866ecca46331e21c46411eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6c9b8bb4fb07ba78a89f8267aee2d6bb5d815c0c866ecca46331e21c46411eb
SHA3-384 hash: 4bc25828e0db6ac4ed5c954e6c0fcf991e87c2405fcf5546808a71c18575750d8f0d5b293c651211dd29550e92fd83fa
SHA1 hash: a8632f066f3db7d083ccabd588ecf46374723109
MD5 hash: 8e7a9c058289527b52a6c5497ef962fc
humanhash: freddie-avocado-december-bacon
File name:SC_TR11670000.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:23'156 bytes
First seen:2020-05-22 09:56:32 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:DG3x0y7eW82VkItAWyUITzddFck4htMnpeDfnM32/fn80xWWoJ4Eoq+D60VqEeeO:S3x0yf82PeNZdF74hipeDPHn80MWoJ48
TLSH 11A2E1274C9AF905CB69F434C64BBC41E4AED83B7488DB139E93913C30B1D642DD6A64
Reporter abuse_ch
Tags:GuLoader rar SCB


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: onepiece.1malaysia-hosting.com
Sending IP: 167.99.78.107
From: Standard Chartered Bank<AdvicesMY@sc.com>
Subject: SUBJECT:Advice from Standard Chartered Bank
Attachment: SC_TR11670000.rar (contains "SC_TR11670000.exe")

GuLoader payload URL:
https://qif.ac.ke/flow_AoGPhiVz245.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 10:37:06 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar a6c9b8bb4fb07ba78a89f8267aee2d6bb5d815c0c866ecca46331e21c46411eb

(this sample)

GuLoader

Executable exe 65d993ca9f1fffaa634838468d8f9401f7f2812aa75065e9805447db5b667720

  
URLhaus
https://urlhaus.abuse.ch/url/365459/
  
Dropping
MD5 f87c9ae83822e6f5e752da50f6332ac0
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 65d993ca9f1fffaa634838468d8f9401f7f2812aa75065e9805447db5b667720

Comments