MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba5c1653ee0078678d28844ac89128adf103e971269961773260899a80a43301. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba5c1653ee0078678d28844ac89128adf103e971269961773260899a80a43301
SHA3-384 hash: 67bd1a953a672226d055d0b175b564c922732d9972398b68ead8a3f5fcd82087a202f5f5ec4e59f3ca08e2b5e77d236a
SHA1 hash: e4be30419c84d9806be7272a3d50f06b4128caba
MD5 hash: d5ece45a8e1e80ac481215ce692e1aa7
humanhash: gee-quiet-seventeen-grey
File name:PO-W9087.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:31'245 bytes
First seen:2020-05-27 17:12:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:EZB1sW111xmOzRjQcpzusKjcvoWHabQ/g3wBr8+I1RDDXMvbt:k111UsLpzuxWoWHabL+I1VYbt
TLSH ACE2E1A9FDC6BF66C4F9F43522912A8F539B3FD6E546F43DC1424E488D50AC6270108B
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: slot0.cherters.net
Sending IP: 45.95.168.241
From: sales02@cherters.net
Subject: Re: Re: PO_W908
Attachment: PO-W9087.zip (contains "PO-W9087.com")

GuLoader payload URL:
https://conveyancing.pro/wp-admin/js/widget/w_BprDFjA52.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Jaik.40167.5291.31649.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 11:38:11 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
31 of 48 (64.58%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip ba5c1653ee0078678d28844ac89128adf103e971269961773260899a80a43301

(this sample)

GuLoader

Executable exe fcaa4b93dbdb7ca43dab06e0afb63117ca21a864f7ccf6f6eb7a4581ded48464

  
URLhaus
https://urlhaus.abuse.ch/url/369925/
  
Dropping
MD5 9caf37f0c2955ab53d227bf6bfbcfbeb
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fcaa4b93dbdb7ca43dab06e0afb63117ca21a864f7ccf6f6eb7a4581ded48464

Comments