🀲🏼 NEW | abuse.ch Community Hub! Earn recognition πŸ… for the malware intelligence you share, climb the leaderboards πŸ“ˆ, and connect with like-minded contributors who share your hunting focus 🀝. Ready to unlock your profile? Go to the Community Hub β†’

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5c641273bfc5fed0ea440d58b1e93588e72164ad57174f1acaec346f3cfeff1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5c641273bfc5fed0ea440d58b1e93588e72164ad57174f1acaec346f3cfeff1
SHA3-384 hash: 9e9199369832b9d6f592bb34213ec61c74c24d9c11532f9ffd4942dca1be8dbb5cdb4c539c0e96c2ece7ffca89b88cb8
SHA1 hash: ddbd22ac5015dc642ea4924e9f8cd9560bcd4767
MD5 hash: 0df9fa4b740cf3bbf549a6e37dded7b3
humanhash: hydrogen-idaho-maine-orange
File name:INV20203006PORDER.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:163'840 bytes
First seen:2020-06-03 13:08:03 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:TSPfxV40r1YTDtykgrKHxLdGKc+o0FDHdZ1gIuwEEOjjtq+aAJ4:2PXr1VKVdhjFD9zdCFJ4
TLSH DDF36B0BED4D8553D1544BBD2D178E793B1DA90D0D441BEF743D6EAAAF322022CAB21E
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail2.bm-cheap.site
Sending IP: 62.173.139.217
From: κΉ€νƒœμ˜ <kwseo@omics.co.kr>
Subject: Rev-Order-june-03-06-20-Quote
Attachment: INV20203006PORDER.img (contains "INV20203006PORDER.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=18enfCOss--dmD9xux02fh_Qi3eB_ySYb

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.NetWire-7996875-0
Create hunting rule

Win.Malware.Razy-7997182-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Razy
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 13:37:55 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wxdecjz37rp62dveidkywhutlchhefsk2vyxj4nmv3bun46p57yq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img b5c641273bfc5fed0ea440d58b1e93588e72164ad57174f1acaec346f3cfeff1

(this sample)

GuLoader

Executable exe 9d545cae8b73e11800aaf794b2919bb8972511e4e217eaf1a51c3f38c17bb412

  
URLhaus
https://urlhaus.abuse.ch/url/376019/
  
Dropping
MD5 2d82c205b2738d827acb5a327e95a606
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9d545cae8b73e11800aaf794b2919bb8972511e4e217eaf1a51c3f38c17bb412

Comments