MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8980e7c60ae987813f6202f7f38843291070a88751a1d1bbcc7e09ca880d23a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8980e7c60ae987813f6202f7f38843291070a88751a1d1bbcc7e09ca880d23a
SHA3-384 hash: b1deb374bed61406e21dcc742a0024914da9c2fb4383ea401f010404a05013328cad5d669cc79c8acc882eda3013222a
SHA1 hash: a6e6209ed18805a4c233caa6dea21a98497399d8
MD5 hash: 7d3702f637a36561e72986ac415b01ad
humanhash: london-bulldog-louisiana-sink
File name:Invoices.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:28'265 bytes
First seen:2020-03-23 06:37:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:JF2164bXBo9Bd9uE3v1sfcFnpMRIj+E3nO99cm1iqC538HMAxA47uLLEwAdERRkm:4bXgB/uE3v1sf8pv+cnq2dA58LeHy
TLSH 76C2F14BAE6BB6D03B609A50902B259E41D9138107EF09EFE5A9DEE70133F1473645CE
Reporter abuse_ch
Tags:COVID-19 GuLoader RAT


Avatar
abuse_ch
COVID-19 malspam

HELO: bcsl.co.ke
Sending IP: 103.99.1.158
From: "Marketing"<info@bcsl.co.ke>
Subject: RE: Due to outbreak of Coronavirus
Attachment: Invoices.rar (Invoices.exe)

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Frs
Create hunting rule
Status:
Malicious
First seen:
2020-03-22 23:16:51 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xcma47dav2mhqe7weaxx6oeegkiqocuiounb2g54y7qjzkea2i5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar b8980e7c60ae987813f6202f7f38843291070a88751a1d1bbcc7e09ca880d23a

(this sample)

GuLoader

Executable exe d87c6077423627f449ad0706b6aae722a75b8cb2bd8f977b01b2ee5d6333b069

  
Dropping
GuLoader
  
Dropping
MD5 1d56006b9a0ea66f000df8cc6bcb1bc6
  
Dropping
SHA256 d87c6077423627f449ad0706b6aae722a75b8cb2bd8f977b01b2ee5d6333b069
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d87c6077423627f449ad0706b6aae722a75b8cb2bd8f977b01b2ee5d6333b069
  
Dropping
SHA256 d87c6077423627f449ad0706b6aae722a75b8cb2bd8f977b01b2ee5d6333b069
  
Dropping
SHA256 d87c6077423627f449ad0706b6aae722a75b8cb2bd8f977b01b2ee5d6333b069

Comments