MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 baa9599e5b36cd3b96cc844f0f87ac8c256f3265a8482e47ead87015002d75c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: baa9599e5b36cd3b96cc844f0f87ac8c256f3265a8482e47ead87015002d75c5
SHA3-384 hash: f6f4b98138316e20edc04a98194d3dff95c3968ba4794740c822f564c280002083a5d536bda4e47038846da15918f684
SHA1 hash: 7492f7fc18d2a833ee6564902f4bdff5ffe4de71
MD5 hash: 67d8d4b8de07d622b568aa93f64f6616
humanhash: freddie-echo-mountain-skylark
File name:AWB0198273-20-05-20.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-21 08:38:57 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:M0inl7qzhKD/SUoItF4H7w78vVx9QolnwmDC3874jjxDcVNYf39zYm/R:M0MIglo9w7mQolnFDi87AgvmZ
TLSH 21452820F6509D70E91482BE1F974A6492AFBD340452CB4770CFBB8D2BF66C2B92174B
Reporter abuse_ch
Tags:DHL GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail.strongmailvault.com
Sending IP: 111.90.144.214
From: Notificacion DHL Express (ChiIe) <notificacion@dhl.com>
Subject: Notificación de DHL Express:Tramitación deEnvío (Guía Aérea: 8158025864)
Attachment: AWB 0198273-20-05-20.IMG (contains "AWB 0198273-20-05-20.exe")

GuLoader payload URL:
http://kuroilersuganda.com/bin_OBmivft151.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.FareitVB-AB.31401.1903.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 09:36:40 UTC
AV detection:
16 of 30 (53.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xkuvths3g3gtxfwmqrhq7b5mrqsw6mtfvbec4r7k3bybkabnoxcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img baa9599e5b36cd3b96cc844f0f87ac8c256f3265a8482e47ead87015002d75c5

(this sample)

GuLoader

Executable exe b65a42512465c82d804bdb56b5e1e633afa4571a20dc68d311ecad4a8fc3654d

  
URLhaus
https://urlhaus.abuse.ch/url/365697/
  
Dropping
MD5 5b437a21d4c542518f33356118540418
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b65a42512465c82d804bdb56b5e1e633afa4571a20dc68d311ecad4a8fc3654d

Comments