MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c06c926f252decaaca3ae1fa78815f5ff563fce119a6d51db1268bac6488c9c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c06c926f252decaaca3ae1fa78815f5ff563fce119a6d51db1268bac6488c9c5
SHA3-384 hash: 22cfd92022dabb1322a73934269fb2fad73eab5dd058152b4d4bd0ab15e168eeede3aa20852d0d758cec82d878a4efd2
SHA1 hash: a88b6607b20f0d8f6fa45e0e26be85ace7fdbca2
MD5 hash: 1d8cea550bba9e5602af70b17f6e2bc8
humanhash: carbon-batman-yankee-friend
File name:Product specifications.lzh
Download: download sample
Signature GuLoader
Create hunting rule
File size:27'756 bytes
First seen:2020-05-26 11:19:29 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:us7fMs6YzcxXwJo+bUSs++ak6MQiPH9iQc6qzmr3Wz7:v7fM74cxAJo+ns++a5MQQIJ33P
TLSH 41C2F13FBB5884E61D9D06180E7AE9E727C23485435488ABB56CC3213F93E31B27F665
Reporter abuse_ch
Tags:GuLoader lzh


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: slot0.aquichab.com
Sending IP: 45.95.169.120
From: Cristina Spatura<info@aquichab.com>
Subject: Re: Send price
Attachment: Product specifications.lzh (contains "Product specifications.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=7D717E2107245D5B&resid=7D717E2107245D5B%21133&authkey=AOJK5W8mUVaOFH0

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 11:37:12 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
18 of 48 (37.50%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar c06c926f252decaaca3ae1fa78815f5ff563fce119a6d51db1268bac6488c9c5

(this sample)

GuLoader

Executable exe 16e85e5268ed68c1741fd6293948d18a7ac9a2854e0938a015f8a894469f88b6

  
URLhaus
https://urlhaus.abuse.ch/url/368648/
  
Dropping
MD5 8167c8858db691ed505975ccb235ca93
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 16e85e5268ed68c1741fd6293948d18a7ac9a2854e0938a015f8a894469f88b6

Comments