MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab3fb19e2eaf67044db997f5e61260f12293ec407e503e35fb4b396fbaba8788. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab3fb19e2eaf67044db997f5e61260f12293ec407e503e35fb4b396fbaba8788
SHA3-384 hash: d154df6d7a6f55e2ff0034ed7e9bb230bb81a601261d8930f30d3ec27106c80a54d95104d2cbdd24ccd3384b19d2bb8f
SHA1 hash: 295645ce2f922c95777fe57de926b26ce1243986
MD5 hash: 543fcaca4e20ba97ba4ebb0a44340790
humanhash: happy-whiskey-east-utah
File name:file.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-28 07:32:05 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:2nNTxW06ET0EF8pxIAbFLMtT9ZTS2HkKKVEdcTWQWS4ho4H/bdMSldOz5PHilLtG:KHT0o8p6AhUoWS4h9RMXl
TLSH 2E452826B676DCB2DA514470D9C1C5F80464BC14CC238ABF71D87F2E37B6186A932776
Reporter abuse_ch
Tags:geo GuLoader img KOR


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm45.hanmail.net
Sending IP: 203.133.180.233
From: Charles Kim(김현철) <jes07@hanmail.net>
Subject: 견적요청서 송부의건
Attachment: file.IMG (contains "file.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1wU-hyiiznY76ILGQdIsrijC4wmgXm44b

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Injector.EMDX.18516.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 07:37:56 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img ab3fb19e2eaf67044db997f5e61260f12293ec407e503e35fb4b396fbaba8788

(this sample)

GuLoader

Executable exe b9faefd420a9117fddd3bdc6c42bc5c5d07d0cec65fdc7acb2d715b752b44967

  
URLhaus
https://urlhaus.abuse.ch/url/370288/
  
Dropping
MD5 ea97440c3145e853ee3c050611dd76e4
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b9faefd420a9117fddd3bdc6c42bc5c5d07d0cec65fdc7acb2d715b752b44967

Comments