MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca631552241e20b52ddcfba1fe261cce6890f6ff74a773e8082f11ce49e9a96c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca631552241e20b52ddcfba1fe261cce6890f6ff74a773e8082f11ce49e9a96c
SHA3-384 hash: ff33fca97ce3ad21f2b708e78353395c02038a621af08eb5a79892f73c304bb8547bda14a9945cf031bad1e998a19d96
SHA1 hash: 9493cfaa1dfb031bf3a6b94177f6b3c6c2287af5
MD5 hash: 05db791ea99dce5d1044ad9bd431a952
humanhash: failed-october-river-nitrogen
File name:Purchase Order.pf.z
Download: download sample
Signature GuLoader
Create hunting rule
File size:18'707 bytes
First seen:2020-10-06 06:00:55 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:7h1/jop+5ikeztx4FO9iyHQLWyGSDJLTv63fln3lLpEMkycTj3Zl0m3:7hG+5iX4OZQCzSDJLTvkflngMkycTjcK
TLSH B382D0EF5BCB942D8112F0BCBD75203A8C931C5B5EB922CEB396D68F93C60D41680B51
Reporter abuse_ch
Tags:GuLoader z


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail.com
Sending IP: 199.115.195.102
From: Eng. M. Husni Abdulwahab <company-procurements@mail.com>
Subject: Purchase Order
Attachment: Purchase Order.pf.z (contains "Purchase Order.pf.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=7B6A3EE1AA3735F9&resid=7B6A3EE1AA3735F9%21117&authkey=AB1wXkw7K-sCyj8

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ca631552241e20b52ddcfba1fe261cce6890f6ff74a773e8082f11ce49e9a96c/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 02:06:05 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zjrrkuredyqlklo47oq74jq4zzujb5x7ostxh2aif4i44spjvfwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Vcrypt
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ca631552241e20b52ddcfba1fe261cce6890f6ff74a773e8082f11ce49e9a96c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip ca631552241e20b52ddcfba1fe261cce6890f6ff74a773e8082f11ce49e9a96c

(this sample)

GuLoader

Executable exe c83ae5695c48f86c4a90f32a1c2e2cf93656d6880e8e5322f671ef79a98fe934

  
URLhaus
https://urlhaus.abuse.ch/url/658345/
  
Dropping
MD5 bfc38d07f22a9d1c389b44d30ffeba86
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c83ae5695c48f86c4a90f32a1c2e2cf93656d6880e8e5322f671ef79a98fe934

Comments