MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa94a10b2d2a2b020aa7dd407df55d507b425c2c759efc9ec990f58b4ec803f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa94a10b2d2a2b020aa7dd407df55d507b425c2c759efc9ec990f58b4ec803f6
SHA3-384 hash: 2dafc25b8b0922ef14a1e550faa7a6f7f41fe267976ee6418d8ec438cf8d180f8ccc4d731e944ca6d16b29803878ece8
SHA1 hash: 76874e1695bc805243082b22b277f1a8b9ff6d3a
MD5 hash: 228cb0396d163c396fbfab529db3af6b
humanhash: robert-quebec-saturn-glucose
File name:品目の照会-013872,pdf.iso
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'052'672 bytes
First seen:2020-05-01 13:34:43 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:oi2KmIpZ7l+/yO3VhZjgMU4eB7hqcXdSu7ecxBOPY4Jvjg3FVLg904yp4lFB:oFGl0ycAF1dSSeqBOPYovEZ4y+f
TLSH 0B25AF62B2C04877D0731E78DD1B93689827BD612A3468C677F93D4C9F393A1393A297
Reporter abuse_ch
Tags:geo GuLoader iso JPN nVpn RAT


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server2-ip13.mailsentinel.net
Sending IP: 111.90.139.20
From: katotech@keskato.co.jp
Subject: 品目の照会-013872
Attachment: 品目の照会-013872,pdf.iso (contains "品目の照会-013872,pdf.exe")

GuLoader pushing RemcosRAT via drive.google.com

RemcosRAT C2:
experience2477.ddns.net:1965 (185.244.30.17)

Pointing to nvpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@FOS-VPN.org'

inetnum: 185.244.30.0 - 185.244.30.255
netname: Freedom_Of_Speech_Foundation_Hungary
remarks: Budapest, Hungary
country: HU
org: ORG-FOSF3-RIPE
admin-c: FOSF1-RIPE
tech-c: FOSF1-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-04-06T19:58:39Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Remcos-7735852-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 13:23:34 UTC
File Type:
Binary (Archive)
Extracted files:
58
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vkkkccznfivqecvh3vah35k5kb5uexbmowppzhwjsd2ywtwiap3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso aa94a10b2d2a2b020aa7dd407df55d507b425c2c759efc9ec990f58b4ec803f6

(this sample)

GuLoader

Executable exe a899d2b8f1cf3d0a97107dcfecafb3239cade9e8aad01fe007f3b0d8762b8b7a

  
Dropping
MD5 d0a2ff7c606f8fbf489b3e595cdf349d
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a899d2b8f1cf3d0a97107dcfecafb3239cade9e8aad01fe007f3b0d8762b8b7a

Comments