MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9aaf6816f63230dcb5a92214f18d4d5b15c95d1165f6c021472b76e40f323f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9aaf6816f63230dcb5a92214f18d4d5b15c95d1165f6c021472b76e40f323f5
SHA3-384 hash: 36ac8ceaa4c20954d64e9d14db7deb72d7ef23f652a2bb931cee8eb6c7ef3be7e34c404c08356fc52db377ba6ec9dd0d
SHA1 hash: cd1ee0211175d96876e0878c562d0d6279f62149
MD5 hash: 4cec79d425d74c74358dda56eb5fef09
humanhash: green-lactose-missouri-ten
File name:DHL_AWB 9284730931.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:73'897 bytes
First seen:2020-06-04 06:03:05 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:lnWSuiTgiW+IOjshrRfoUnFvQSJb5c22v/IDB6t0s0/EQJpRnmD:lZuQZbI8sIaFvQ8FcBOoiBpmD
TLSH 2A7302DF34CD7DB75460DF76574B2DF43EA661401D43F82AC2AA3A3CB2ADA8611A409C
Reporter abuse_ch
Tags:DHL GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server.gtrit.com.my
Sending IP: 103.18.246.122
From: DHL Express<eawb@iddhl.com>
Subject: EAWB Notification
Attachment: DHL_AWB 9284730931.rar (contains "DHL_AWB# 9284730931.exe")

GuLoader payload URL:
https://qif.ac.ke/flow_AoGPhiVz245.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 03:57:05 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vgvpnalpmmrq3s22siqu6ggu2wyvzforczpwyaquok3w4qhtep2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar a9aaf6816f63230dcb5a92214f18d4d5b15c95d1165f6c021472b76e40f323f5

(this sample)

GuLoader

Executable exe e09c2eb3f06cc722f1035d501755645c3feb569441f465ae3ba69aa4aba6ffa1

  
URLhaus
https://urlhaus.abuse.ch/url/365459/
  
Dropping
MD5 a13bdd2d69b271129dc8237834b4790c
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e09c2eb3f06cc722f1035d501755645c3feb569441f465ae3ba69aa4aba6ffa1

Comments