MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd820055d253380a1b28583b2a6f4a320910303bde2ef5cd73d02a01c19d52e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd820055d253380a1b28583b2a6f4a320910303bde2ef5cd73d02a01c19d52e9
SHA3-384 hash: 1f26101b8b37942de7342ba76be1ac0704f539c0843bb90b4908c61a7d5118349b216ca18378134e41572a5fc89f7420
SHA1 hash: fd0a332909bdf5d775e59d724699daa74e5b147e
MD5 hash: efbeca2e38234e8df651d1d95e605e35
humanhash: tango-july-ten-kansas
File name:TR COVID-19 order RFQ.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-04-08 10:53:55 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:TFA+BcTGptd1AvWatywvUamxsiHHq0a9C2cTBU:BA+mS1VatywvUa3FMu
TLSH 9745D6A57760FAE5F00208F4B979BE7864F83C312618540FFBC67365667AA48F834693
Reporter abuse_ch
Tags:COVID-19 GuLoader img


Avatar
abuse_ch
COVID-19 themed malspam distributing GuLoader:

HELO: vm02-monty.h4ahosting.com
Sending IP: 41.72.154.151
From: Lia Pozvek <dokadalogistique@gmail.com>
Subject: Re: TR: COVID-19 order RFQ
Attachment: TR COVID-19 order RFQ.img (contains "New Order Set Documents.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1v9S2PulMt_BVCwTNUMpWG9zdn2ft7Nzp

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.VBGeneric-7652592-0
Create hunting rule

Win.Packed.Generic-7663293-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-08 11:36:42 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
22 of 47 (46.81%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xwbaavoskm4augzila5su32kgieramb33yxpltlt2avadqm5kluq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img bd820055d253380a1b28583b2a6f4a320910303bde2ef5cd73d02a01c19d52e9

(this sample)

GuLoader

Executable exe b39e4e2e3b7412b08824434b0cce7049fcca04761e4e88ba3ea510fabbd43d07

  
Dropping
MD5 0c65dbfcab3d666f8297152000fe6f6c
  
Dropping
SHA256 b39e4e2e3b7412b08824434b0cce7049fcca04761e4e88ba3ea510fabbd43d07
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b39e4e2e3b7412b08824434b0cce7049fcca04761e4e88ba3ea510fabbd43d07

Comments