MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4b5846ab10b6ac87f6f176bcb8a3f76a720628fd8b1aa9d7c1f603192f67bd0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: c4b5846ab10b6ac87f6f176bcb8a3f76a720628fd8b1aa9d7c1f603192f67bd0
SHA1 hash: 27e3ef432eab3b6aa22ef74555efc7e9f1b0ff42
MD5 hash: 438e1a6a0b443e233277a1f575374241
File name:Billing_Statement-162315070.xlsx.exe
Download: download sample
Signature GuLoader
File size:102'400 bytes
First seen:2020-05-22 09:49:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1837609478fe760f0f96cbd6700d17c0
ssdeep 768:EAQaxii1OqmZJl0NFM3sVmweCaAQN9Uncw+fUoxnHaw30NvpJ+aGDZ1jks:vow8ZJlg1ep3HMxo1Hz30N6aKZt
TLSH 78A32B3178E0EC51EA5485F2AE674779192BBCB015468A47F3C77F2C29326D2E86334B
Reporter @abuse_ch
Tags:exe GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: mxserver22-out4.masterweb.com
Sending IP: 103.25.223.204
From: Total Credit Management Services Ltd. <inquiry@totalcredit.hk>
Subject: Billing_Statement-162315070; 162315090
Attachment: Billing_Statement-162315070.rar (contains "Billing_Statement-162315070.xlsx.exe")

GuLoader payload URL:
https://qif.ac.ke/komi_yUyfmoyRdV90.bin

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 23
Origin country US US
ClamAV PUA.Win.Packer.ProtectSharewar-2
PUA.Win.Packer.ProtectSharewar-3
VirusTotal:Virustotal results 32.86%
ReversingLabs :No data

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe c4b5846ab10b6ac87f6f176bcb8a3f76a720628fd8b1aa9d7c1f603192f67bd0

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments