MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a89513ea9aed78fccbb98daecf9b3d985c48158e0b9d42ca9861af303aaf2b92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 5 Yara Comments

SHA256 hash: a89513ea9aed78fccbb98daecf9b3d985c48158e0b9d42ca9861af303aaf2b92
SHA1 hash: bd1948e0512b9c5637cb2f49ee50f68cb7e45840
MD5 hash: 2531ddb456225a073eaf546b28cec7c8
File name:Outstanding Invoice_9389373_05_2020.arj
Download: download sample
Signature GuLoader
File size:26'521 bytes
First seen:2020-05-22 10:12:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:VmHwJmYsnsh3zc5wbFplEWG2Lbj+hlM/SIiG3:VOwJ5tbFD7Lbj+hOSI53
TLSH E6C2E00B1B0F2911E30C6C4EA135F0262BE6BE4D11EFE9ED35D896C2A21D4005DAB23F
Reporter @abuse_ch
Tags:arj GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: mail.nwiran.com
Sending IP: 185.94.98.43
From: UTLX METAL WORKS Co. <info@kts-me.com>
Subject: Invoice Confiirmation prior to Payment
Attachment: Outstanding Invoice_9389373_05_2020.arj (contains "Outstanding Invoice_9389373_05_2020.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=16pdtfZQsIuTKlvUWbPTFf7qt38rdyUVy

Intelligence


Mail intelligence
Trap location Impact
Global Medium
# of uploads 1
# of downloads 23
Origin country US US
ClamAV PUA.Win.Packer.ProtectSharewar-2
PUA.Win.Packer.ProtectSharewar-3
VirusTotal:Virustotal results 9.38%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip a89513ea9aed78fccbb98daecf9b3d985c48158e0b9d42ca9861af303aaf2b92

(this sample)

  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment

Comments