MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4ecbbb0b0a77441777b410cd470e87c5cfa866e3083ff90b208829e7b20213c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c4ecbbb0b0a77441777b410cd470e87c5cfa866e3083ff90b208829e7b20213c
SHA3-384 hash: 08f2cd4bbcbf1b49c99dd8d2f99a5010327e8760831f9574b7d9502949a4a62d589c20caec38dcc7dcc68dbaa476b042
SHA1 hash: e064a1a440d0e805aa436996266225bd6a9e1383
MD5 hash: 5345de9b08b2eb39d535a5e50a7abf40
humanhash: alabama-kilo-montana-timing
File name:Products_Order_Pictures.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:64'346 bytes
First seen:2020-08-13 07:33:11 UTC
Last seen:2020-08-13 07:35:00 UTC
File type: zip
MIME type:application/zip
ssdeep 1536:NMHQeH/lJO4RgCyJV53xJu8giKWdm/Z4SQ/2OqZ:Mft9+Vq8gkmGS22Z
TLSH 61531238CA71D355E49CA19B4D14B0794BC4DA9203660B1F0E905F7210ABF4FE5BCEEA
Reporter abuse_ch
Tags:GuLoader HostGator zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: hwsrv-760908.hostwindsdns.com
Sending IP: 104.168.213.82
From: info@kamaehr.com
Reply-To: info@kamaehr.com
Subject: Quote#CON-071720-EB
Attachment: Products_Order_Pictures.zip (contains "Me.jpg.jpg.scr")

GuLoader payload URL:
https://onedrive.live.com/download?cid=7FED4FBEA32E3C1E&resid=7FED4FBEA32E3C1E%21107&authkey=AEoXfycPoLIFch0

Intelligence

File Origin
# of uploads :
2
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader34.22379.10319.23654.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.DownLoader34.22379.8622.25613.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c4ecbbb0b0a77441777b410cd470e87c5cfa866e3083ff90b208829e7b20213c/
Threat name:
Win32.Trojan.Caynamer
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 07:35:05 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ytwlxmfqu52ec533iegni4hipropvbtogcb77efsbcbj46zaee6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Cryptor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c4ecbbb0b0a77441777b410cd470e87c5cfa866e3083ff90b208829e7b20213c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip c4ecbbb0b0a77441777b410cd470e87c5cfa866e3083ff90b208829e7b20213c

(this sample)

GuLoader

Executable exe 03d585ea89f4e62bc18d42d1fadad0b02faca6d68c831e79fb542e9efd183f7a

  
URLhaus
https://urlhaus.abuse.ch/url/431586/
  
Dropping
MD5 0e8e6a549566991b7e630ca82f9235f3
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 03d585ea89f4e62bc18d42d1fadad0b02faca6d68c831e79fb542e9efd183f7a
  
Dropping
SHA256 3ab58a49c5634a26cb2f625a97ad065d8f03d8dce711e2581e3521e2bae2b6c8
  
Dropping
MD5 b39376d21c173d4865cb64dcdd4627d3

Comments