MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b32c66c1484b4e4f1ebd92363a4def67a5d73eec5cdc5ed173e7aaa4583b06bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b32c66c1484b4e4f1ebd92363a4def67a5d73eec5cdc5ed173e7aaa4583b06bf
SHA3-384 hash: b7d8a1e74b6dc7571f0b1395be66c2d61e8a879485c6a9f8f45a208696e42dc420a79ea1520e1100d1b870a6f1afa588
SHA1 hash: 4fd2c37832078b21f7eb864b31baf5d55357cff8
MD5 hash: b9b1ffbea0abd58b55d773dbe2673c25
humanhash: edward-wisconsin-pip-equal
File name:Attachments cotización.pdf.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:45'168 bytes
First seen:2020-06-06 08:41:23 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 768:/6IHNB5RDepEI2FllvFOH/HNVvbA0kbfZGnKoTDDjj9+Ectg1X8x1CbNtMnFEcVd:/5HNRepEDB8NpA0kKKobjj9AtgDtMnqu
TLSH D5130255079F62B7668F567457241842E19BFB4C8D6E02164CCAAD0CBBB1BEE0A3F0CD
Reporter abuse_ch
Tags:GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: aa98419.online-server.cloud
Sending IP: 74.208.129.40
From: Cynthia <CynthiaEstefania.Rodriguez@hlag.com>
Subject: Muy urgente Nueva consulta / orden de cotización
Attachment: Attachments cotización.pdf.gz (contains "Attachments cotización.pdf.gz.bat")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1CMM9WpZKcPC1Pxv-y4JNZZeV2Kby2Dpa

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-06 08:43:04 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wmwgnqkijnhe6hv5si3dutppm6s5opxmltof5ult46vkiwb3a27q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz b32c66c1484b4e4f1ebd92363a4def67a5d73eec5cdc5ed173e7aaa4583b06bf

(this sample)

GuLoader

Executable exe dbf51889fb95ed46a824128ef165335d4662021bd8974f850e168478b77fe3cc

  
URLhaus
https://urlhaus.abuse.ch/url/382437/
  
Dropping
MD5 0c3aad1dd71413abb902f2500222d168
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dbf51889fb95ed46a824128ef165335d4662021bd8974f850e168478b77fe3cc

Comments