MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf2b66a45658ffdae97a6db88d3e039ee9682eebf06e9deebdda5bb539ae40a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf2b66a45658ffdae97a6db88d3e039ee9682eebf06e9deebdda5bb539ae40a1
SHA3-384 hash: 05c0e5bb11612fb4718cd27ac5d332f77f66f3dba21117f9b56d7a3f7310775ed73b13c61db1507f16f977a364540973
SHA1 hash: 73d78ea9a169c166c3877c7f0a8141c45a310d92
MD5 hash: d408cac3e7c1e08bf7541fc73e7d73bd
humanhash: louisiana-item-oven-zulu
File name:rechnung.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:108'789 bytes
First seen:2020-06-03 13:39:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:LfNp0Kokf2pGLLl5EvrMYfyUl5oyvL/tj66gsx+fDO0uNp8pr6K9uxm:LFp0cfWcl5EvrDfhTomtjzgoKgy5Qxm
TLSH B3B31284ADBEE78ED23064F4C655E06725C64FFDA7112A687090C738A16FB1C677B8C2
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: dd29502.kasserver.com
Sending IP: 85.13.151.31
From: Sebastian Klein <info@klein-gala.de>
Subject: AW: AW: Zahlungsbeleg und Auftragsbestätigung 2-06-20 Rechnung_20-613129926-001
Attachment: rechnung.zip (contains "rechnung.exe")

GuLoader payload URL:
http://156.96.118.179/slxslx-2RAW_gwKBF147.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
MiscreantPunch.SingleXOR.EXE.197.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23811.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Virus.Floxif
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 13:47:08 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
35 of 48 (72.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x4vwnjcwld75v2l2nw4i2pqdt3uwqlxl6bxj33v53jn3konoicqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip bf2b66a45658ffdae97a6db88d3e039ee9682eebf06e9deebdda5bb539ae40a1

(this sample)

GuLoader

Executable exe 3480ae4f4ba35f9f2c70d89ad705ff9b64aab46de7e7df8942b1425d67d0eebc

  
URLhaus
https://urlhaus.abuse.ch/url/374619/
  
Dropping
MD5 5169115479eaa7b6ed82ee4baa2aea80
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3480ae4f4ba35f9f2c70d89ad705ff9b64aab46de7e7df8942b1425d67d0eebc

Comments