MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4c3356e7c18d31ecf7e7e48b50a902810dba13ce5db47998cbca3b0cc1238ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4c3356e7c18d31ecf7e7e48b50a902810dba13ce5db47998cbca3b0cc1238ad
SHA3-384 hash: 86d4aa4772bdf4705839514387135de062bfb25b88a35bf777bcdcce1e9eebd2ed57f5814fbaeb27d061ef739aac483a
SHA1 hash: b1e1a7d18ba67412cb0e24aee724c5926a10c0f1
MD5 hash: 2c735795babbd52e1916746e944131d3
humanhash: maryland-magnesium-queen-item
File name:po-0049205.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:293'138 bytes
First seen:2020-04-30 09:37:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:YH6Xr1FsyrDlSXWy4cKADuUL/7jw9wi1fTwF/Zzyg0JthCXpo+Emm:JkyonvL7jw9pBTKZudx+Pm
TLSH EB5423471F2798E8656AA39A8F3CB17F01FD6D74D909B1332F729BA128A1645030DE27
Reporter abuse_ch
Tags:geo GuLoader JPN nVpn RAT zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: smtp97.iad3a.emailsrvr.com
Sending IP: 173.203.187.97
From: 東邦液化ガス株式会社 <yamauchi-jyunko@tohogas.co.jp>
Subject: 見積もり依頼
Attachment: po-0049205.zip (contains "po-0049205.exe")

GuLoader dropping unknown RAT.

RAT C2:
185.244.30.81:42017

Hosted at nvpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@FOS-VPN.org'

inetnum: 185.244.30.0 - 185.244.30.255
netname: Freedom_Of_Speech_Foundation_Hungary
remarks: Budapest, Hungary
country: HU
org: ORG-FOSF3-RIPE
admin-c: FOSF1-RIPE
tech-c: FOSF1-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-04-06T19:58:39Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 04:30:02 UTC
File Type:
Binary (Archive)
Extracted files:
41
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wtbtk3t4ddjr5t36pzelkcuqfainxij44xnupgmmxsr3btashcwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip b4c3356e7c18d31ecf7e7e48b50a902810dba13ce5db47998cbca3b0cc1238ad

(this sample)

GuLoader

Executable exe d6d6bd58488eb5f37fdba905ac0cb83e0cdb648ff2531cff16a76f2b2cbe5e84

  
Dropping
MD5 94c98e7686ce0a56270cbd4e8b7b750e
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d6d6bd58488eb5f37fdba905ac0cb83e0cdb648ff2531cff16a76f2b2cbe5e84

Comments