MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a776a9798354f10514f4b1fd92f71bbb605e97b22de0cb583645510030b32902. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a776a9798354f10514f4b1fd92f71bbb605e97b22de0cb583645510030b32902
SHA3-384 hash: 457bd2504bbbcc056892e15b98ae26dddaaa4f4f63cc16a8fb3a94a95cf0f11139eff61e8eddf6823682173d07c10fc1
SHA1 hash: a818687e3e44759b4c03fe21bb00a51ff00196bc
MD5 hash: 6f9ff5d86d7aa1c378ddacf1b3bc4596
humanhash: carpet-jersey-finch-mike
File name:RFQ CTC Group Global 934363IMG.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:167'936 bytes
First seen:2020-05-28 13:13:54 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:c3NnpoEYV3pqQzSUQcvRrVr3fWo5vfPWXEdMq1AU8wCt++HxyU5zHLYbCdN1:inC1VRrVrt5eXEdMqWU8wCt9XLLYY
TLSH 22F3F6236A90EB11D43049F039178B9D196BBE3001E2994B70DD6B5E3B73AD6F91D34B
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

From: Titus S Kemp <procurement officer@ctc-group.com>
Subject: RE: Urgent Request Quotation CTC Group Global For HTR 864
Attachment: RFQ CTC Group Global 934363IMG.img (contains "RFQ CTC Group Global 934363IMG.com")

GuLoader payload URL:
https://onedrive.live.com/download?cid=FB75FAF15D475DC5&resid=FB75FAF15D475DC5%21106&authkey=AHLe80mX-OphIks

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Gen.NN.ZevbaF.34122.gm0@a4CL52hG.15604.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 13:38:19 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img a776a9798354f10514f4b1fd92f71bbb605e97b22de0cb583645510030b32902

(this sample)

GuLoader

Executable exe b6790b8266a96dea4882a210b98a468cc07ebe940f9cd959f52ea5281eec0e50

  
URLhaus
https://urlhaus.abuse.ch/url/370983/
  
Dropping
MD5 ddef2a936708c4619a7279b757a62f2a
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b6790b8266a96dea4882a210b98a468cc07ebe940f9cd959f52ea5281eec0e50

Comments