MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aba4ceb49b53bd4e7a0d50285a8463a0f984a81e89e44ef2c35db47cbcaf5111. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aba4ceb49b53bd4e7a0d50285a8463a0f984a81e89e44ef2c35db47cbcaf5111
SHA3-384 hash: c1d034193ebb21562a851221ca055b7efb4533c4158933b7ab0d87ef01d25989e0a286ed101ba1d6092377d6d27eb87e
SHA1 hash: 197d8cbfc153ba0833f8638db8407062cb67c4cd
MD5 hash: 75f25b367e524a80524bb8a6f9c8ec4e
humanhash: foxtrot-batman-bravo-angel
File name:po-00298575.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:327'678 bytes
First seen:2020-05-04 20:38:14 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:gV23jU6DI5BLwZ558+HRU7ebkTepL7YTbYzEXWorYSDIpWIrWwDt6rW:t3jU6DI345jsOLtYntYSk1Zt6rW
TLSH B564237DAEBE218AE87C7836124C793C603F684C6ACDD6B6271A724F7D17A5078991C0
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: smtp66.iad3a.emailsrvr.com
Sending IP: 173.203.187.66
From: Chatchaya T <chatchaya.t@maybank-ke.co.th>
Subject: QUOTE
Attachment: po-00298575.zip (contains "po-00298575.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Downloader.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 04:03:15 UTC
File Type:
Binary (Archive)
Extracted files:
42
AV detection:
18 of 48 (37.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vosm5ne3ko6u46qnkaufvbddud4yjka6rhse54wdlw2hzpfpkeiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip aba4ceb49b53bd4e7a0d50285a8463a0f984a81e89e44ef2c35db47cbcaf5111

(this sample)

GuLoader

Executable exe a8dbee5d6f9767662f2a5e0dcbdf672f7e1738a28a9638daa5642aab6ed4fbf3

  
Dropping
MD5 eb9600a58b504a1a3c7cf01d8109adef
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a8dbee5d6f9767662f2a5e0dcbdf672f7e1738a28a9638daa5642aab6ed4fbf3

Comments