MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2769aa2054cdad5c476b718e569c6445d9013e82a86b73c339c928cbef9d905. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 5 Yara Comments

SHA256 hash: c2769aa2054cdad5c476b718e569c6445d9013e82a86b73c339c928cbef9d905
SHA1 hash: 175f092201f70ba5cc6a05d60ebe07247e5a5515
MD5 hash: c8b0f5372d0cc36795694a46588bc48a
File name:Rechnung..zip
Download: download sample
Signature GuLoader
File size:30'637 bytes
First seen:2020-05-23 15:16:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:fbMVlPGeKW0les+3a8buWWTlgcGie1e16kPiV0z:g/ueF04siUDlgcGiB16/V0z
TLSH 74D2F125EEE13A9364121D39D20D790F09B49BCCF8749BDCC7983EB00578D6D260BAA7
Reporter @abuse_ch
Tags:DEU geo GuLoader zip


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: dd37126.kasserver.com
Sending IP: 85.13.153.207
From: info@schloss-willebadessen.de
Subject: AW: AW: Zahlungsbeleg und Auftragsbestätigung 23-05-20 Rechnung_20-613129926-001
Attachment: Rechnung..zip (contains "rechnung1.exe")

GuLoader payload URL.
http://156.96.118.179/RSol.bin

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 23
Origin country FR FR
ClamAV Sanesecurity.Malware.23811.ZipHeur.UNOFFICIAL
VirusTotal:Virustotal results 15.62%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip c2769aa2054cdad5c476b718e569c6445d9013e82a86b73c339c928cbef9d905

(this sample)

  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment

Comments