MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1e5617a5333ec9fd9c3eaa4dc26f1510dbf31ce2282aa21f7c05d81d1231e91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1e5617a5333ec9fd9c3eaa4dc26f1510dbf31ce2282aa21f7c05d81d1231e91
SHA3-384 hash: 7c5c8985b1bd5abae16855fb1ee97e04db998d1789f29f556387ffbb1c5655919f04c9778f5c6a7f2a49f8ae8bb8e4e5
SHA1 hash: 2a01e66f8242f282da8c7274a2f5556e0fb18a37
MD5 hash: 3b243488adcc1e7f4735495e3ff1b5f7
humanhash: connecticut-autumn-iowa-music
File name:CMathari specification sheets pdf.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:26'294 bytes
First seen:2020-04-17 07:22:12 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 768:NeaaTxOOkX4zsfCfpehC8JNmVsCWoNKHvTg/:NeaaTxO+AfIp8hU+CWE/
TLSH 10C2E163B756514BED30A71043981474CEA12BDC149C8B11FEB29C9F547FE80924B9BE
Reporter abuse_ch
Tags:arj COVID-19 GuLoader


Avatar
abuse_ch
COVID-19 themed malspam distributing GuLoader:

HELO: cmatharihospital.co.ke
Sending IP: 209.58.149.66
From: "PROCUREMENT"<procurement@cmatharihospital.co.ke>
Subject: Re: Request for quotation for COVID-19 medical supplies
Attachment: CMathari specification sheets pdf.arj (contains "CMathari specification sheets pdf.bat")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1JjINt15aGYMLnhka6bVHB0FaLAjpjyWg

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-17 07:35:33 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
20 of 47 (42.55%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yhswc6stgpwj7wod5ksnyjxrkeg36mooekbkuipxyboydujdd2iq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

arj c1e5617a5333ec9fd9c3eaa4dc26f1510dbf31ce2282aa21f7c05d81d1231e91

(this sample)

GuLoader

Executable exe f71b8185345a7a8d923db61ae9c9f68bb53b7c3d26e825aa80dca05c5879cc87

  
URLhaus
https://urlhaus.abuse.ch/url/342032/
  
Dropping
MD5 7dde7c9cd99e746cfba02aab9d123e95
  
Dropping
SHA256 f71b8185345a7a8d923db61ae9c9f68bb53b7c3d26e825aa80dca05c5879cc87
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f71b8185345a7a8d923db61ae9c9f68bb53b7c3d26e825aa80dca05c5879cc87

Comments