MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a72e54750583b7abab247add1f874a404defe4a62094f69e0774dfd74d0a0732. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a72e54750583b7abab247add1f874a404defe4a62094f69e0774dfd74d0a0732
SHA3-384 hash: 41c448e561434fc6ed295317d9f915c01ccd59eda4a8e66765b1cfdfd5e2923c7c1b795cba08a6f976f9c416222c407c
SHA1 hash: cc218c30e6b4d54013893ebcf4506d03b43ac1ad
MD5 hash: 9916e3c3c995e2a5306675fbede1b9b7
humanhash: delta-robert-eighteen-arkansas
File name:Our Ref 0050052020.tar
Download: download sample
Signature GuLoader
Create hunting rule
File size:28'980 bytes
First seen:2020-05-05 10:44:38 UTC
Last seen:Never
File type: tar
MIME type:application/x-rar
ssdeep 768:fhSxHvnXGlpgawclkfFwqokBEiZoWs4nvFruGkJSpsQ/:f6HvXGlpVrkBXsuPsSpD
TLSH 26D2D0B3514DEC71EC06CA14A5370DDD8813DBEA009DADFD808191A398CAA9DB93B72D
Reporter abuse_ch
Tags:GuLoader Loki tar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: imailtoolsbulk.top
Sending IP: 117.50.3.249
From: Sales Representative-Wire <sales@imailtoolsbulk.top>
Subject: Our Ref 0050052020
Attachment: Our Ref 0050052020.tar (contains "Our Ref 0050052020.exe")

GuLoader pushing Loki

Loki payload URL:
http://castmart.ga/~zadmin/xcloud/apslo_YtEvxbIn153.bin

Loki C2:
http://allenservice.ga/~zadmin/lmark/ap0s/link.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 11:37:05 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u4xfi5ifqo32xkzeplor7b2kibg67zfgeckpnhqhotp5otika4za._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

tar a72e54750583b7abab247add1f874a404defe4a62094f69e0774dfd74d0a0732

(this sample)

GuLoader

Executable exe 969a6ae609d48434fc77838a81d18bd5b93363cea8c1035cb84c091592df8789

  
Dropping
MD5 9715efbccd1ca64197595d90166df7c2
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 969a6ae609d48434fc77838a81d18bd5b93363cea8c1035cb84c091592df8789

Comments