MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1cbbc6ed70231d5cf6c15d0aa97e8eda26eb88213833d8d19e56857ec8ba08f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1cbbc6ed70231d5cf6c15d0aa97e8eda26eb88213833d8d19e56857ec8ba08f
SHA3-384 hash: 00c76e2469d04dc09ba462c42238bf18f07ba774a7f535d1ff68f8a1427a9a75aed649a6ae7d58402b70d63a995fb6d3
SHA1 hash: cba699ad1501329e28f5010092aa99946264b189
MD5 hash: 007248087eaa5f8dac332872a58994f9
humanhash: utah-hot-summer-minnesota
File name:RFQ Equipment, Devices,Machines And Material Specifications-BID-180400940-S~.iso
Download: download sample
Signature GuLoader
Create hunting rule
File size:143'360 bytes
First seen:2020-05-27 12:59:50 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 1536:+EFm50XncCCeAPEeJqc3xAo/XJ/FBmyA:lFm50XncCCek/3fMf
TLSH 0EE3F81778A44D60E9038572EC7399FD0A9BAC350C911F0BB99C7F8E87B7282F965316
Reporter abuse_ch
Tags:geo GuLoader iso KOR


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm44.hanmail.net
Sending IP: 203.133.180.232
From: 최현종 <sg-ab@hanmail.net>
Subject: 견적의뢰의 건 (REF NO.J190802-160) :JN1328: RFQ
Attachment: RFQ Equipment, Devices,Machines And Material Specifications-BID-180400940-S~.iso (contains "tilmelding.exe")

GuLoader payload URL:
http://ukaimc.webredirect.org/uploud/5bab0b1d864615bab0b1d864b3/bin_AVQtU222.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.50069.4747.30093.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Grp
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 08:38:36 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
9 of 30 (30.00%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso c1cbbc6ed70231d5cf6c15d0aa97e8eda26eb88213833d8d19e56857ec8ba08f

(this sample)

GuLoader

Executable exe 27b805e1ceddb91ebec39349aa21ea5619c84e4c6ef3eb439b8156d66813e13e

  
URLhaus
https://urlhaus.abuse.ch/url/369895/
  
Dropping
MD5 8d41f4a492017be7c529a1630e3906f8
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 27b805e1ceddb91ebec39349aa21ea5619c84e4c6ef3eb439b8156d66813e13e

Comments