MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4d2cc263a89244d7beb6b77194f0dc29e7b8c8b15e0b3471202eeea5b63c17d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4d2cc263a89244d7beb6b77194f0dc29e7b8c8b15e0b3471202eeea5b63c17d
SHA3-384 hash: ab851447c4529f215646a4705bbccd7607586809ee9e0f9e701e60bbe993d09fb93b061e335fbffb2d3907053d9be534
SHA1 hash: cb0893d968869ba1f3174bc6348b3ec38b419068
MD5 hash: ffc091aa12c2d6fd10417d12532d83ae
humanhash: green-beryllium-twenty-mockingbird
File name:2003GY0981.z
Download: download sample
Signature GuLoader
Create hunting rule
File size:47'662 bytes
First seen:2020-06-02 11:25:40 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 768:d9wUMQR7caykQpAYGny7pdrIrKGWZ+WZQR12N1HpPtSQitJ2AtTp:QUMYA+gAYGyn8g62lyHLJtV
TLSH B223F1025F2853721D715F2A3C9D53B4BF87D20DB3551A22AFBAF84E05B86B5D3B0901
Reporter abuse_ch
Tags:GuLoader z


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: park-mx.above.com
Sending IP: 103.224.212.34
From: Yang, Johnny <info@intouchsport.net>
Subject: Order 2003GY00981
Attachment: 2003GY0981.z (contains "2003GY0981.exe")

GuLoader payload URL:
http://188.165.89.101/office_qZdNudqVBk103.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 08:57:24 UTC
AV detection:
14 of 31 (45.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wtjmyjr2rese267lnn3rstynykphxdelcxqlgrysalxouw3dyf6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

z b4d2cc263a89244d7beb6b77194f0dc29e7b8c8b15e0b3471202eeea5b63c17d

(this sample)

GuLoader

Executable exe 59fa3af71958cd38baf920669e982c36378319c61006d360a8db9de50a75f5b7

  
URLhaus
https://urlhaus.abuse.ch/url/374148/
  
Dropping
MD5 b8c1c00d21bdedf19664812a3ff50b6b
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 59fa3af71958cd38baf920669e982c36378319c61006d360a8db9de50a75f5b7

Comments