MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2dd8076e0be5f411f0677f1e03f7fc9cdae5df7072200d894e7247b4a5f5a2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: c2dd8076e0be5f411f0677f1e03f7fc9cdae5df7072200d894e7247b4a5f5a2c
SHA1 hash: 38ad666087ab4b90c9c6d86e5efe44a432c99d69
MD5 hash: 8ea0b2be2febe4eddf6e453340812694
File name:File.scr
Download: download sample
Signature GuLoader
File size:94'208 bytes
First seen:2020-05-22 15:04:33 UTC
Last seen:2020-05-22 15:48:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9e3640e71786502ec4d9e27f3161fb10
ssdeep 768:r8TmHysPc38ZTwT1gQ4MW9zntO5TGFhGBB5OV5ePSyVO6PNYPUEqso:4TRUcsZzhMW9zyGnyVO6VU5m
TLSH 8393E765B190D9BBCE304FF1A97182A41067FC3539504F23B5C63B2C6A3648ED9353AB
Reporter @abuse_ch
Tags:GuLoader scr


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: mx5.chaiyohosting.com
Sending IP: 58.181.206.97
From: <vichai@technoplast.co.th>
Subject: Purchase order.
Attachment: PO 7467.gz (contains "File.scr")

GuLoader payload URL:
http://creativewg.com/feed_sxnWm239.bin

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 26
Origin country US US
ClamAV PUA.Win.Packer.ProtectSharewar-2
PUA.Win.Packer.ProtectSharewar-3
VirusTotal:Virustotal results 15.28%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe c2dd8076e0be5f411f0677f1e03f7fc9cdae5df7072200d894e7247b4a5f5a2c

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments