MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd78e04f608afb00e5ffe792a7c268119b63bba7553e26361ac3c1264f0a5bde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd78e04f608afb00e5ffe792a7c268119b63bba7553e26361ac3c1264f0a5bde
SHA3-384 hash: 268cdd32d0b927bba9b9a1bc37d0fd5d181e59a8f50d4b9e4ca6632de448c7b803c5f2de5c1e992c5e59c24fb349b490
SHA1 hash: 146734ce88b1ad57dd809362567330214b001f9d
MD5 hash: 3350c5f358a31ed8dafca30d535c75f7
humanhash: asparagus-kitten-november-zebra
File name:PTOR000037520_PDF.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:35'182 bytes
First seen:2020-06-02 11:28:31 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 768:vS2mcv7Zed6PBWf7/fTm7MEXpxuKxr2z+do21aBgPkmco1gC6lO8btUc3ntixA:v75dG6PiL+MEXpxuKYzTgPJR6ZtfnExA
TLSH 31F2F110072AB3BAB0EF7626AAC6BCD337D618B015E163C48E62CBF5532401865ED4DB
Reporter abuse_ch
Tags:DHL GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: vps.gibalto.es
Sending IP: 82.194.93.48
From: DHL EXPRESS <pt.ebilling@dhl.com>
Subject: Your last DHL Global Consolidated invoice: PTOR000037520
Attachment: PTOR000037520_PDF.gz (contains "PTOR000037520_PDF.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1PP8W-2FMMVl8nMnGTheJ7NEx3XFnvFAh

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 11:37:41 UTC
AV detection:
20 of 46 (43.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zv4oat3arl5qbzp746jkpqticgnwho5hku7cmnq2ypasmtyklppa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz cd78e04f608afb00e5ffe792a7c268119b63bba7553e26361ac3c1264f0a5bde

(this sample)

GuLoader

Executable exe 559ac9a08e2263a036dc045b7ad9e9bba2b5115de42ab57d75e5e6bb168ceeb9

  
URLhaus
https://urlhaus.abuse.ch/url/374415/
  
Dropping
MD5 e5e13115542ea5441209a45a46e3d0b9
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 559ac9a08e2263a036dc045b7ad9e9bba2b5115de42ab57d75e5e6bb168ceeb9

Comments