MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf504ac4e9f71adab18c28a7874ba101aeaae121dd86f73a8ea8519951ffd05f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf504ac4e9f71adab18c28a7874ba101aeaae121dd86f73a8ea8519951ffd05f
SHA3-384 hash: c2b3ad5e12fd9b5320552504370ccfab55fad73466a9cecc657ed86891a7a49a0dbcf75a9643b0ae3450c7126dd3183d
SHA1 hash: def532a1fc41f2bcf6bfb001e396a54fe477e0ad
MD5 hash: ea3d77ab5ab61b3ef98eb9c6acec392d
humanhash: south-thirteen-gee-south
File name:RFQ 13970 DTgz.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:86'004 bytes
First seen:2020-06-04 15:51:12 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 1536:ZPASusGwOeAJbINs186tzjkMUExuG0wRedB9wfZQeI6V/h3/J0yzKbuR:Z4S/Gwc8Ns186ljkMIYReJUZQly/9Om
TLSH 62830243F9B10328DD28590025DEFF889BF0E935A1513665F19A8DB7235237EEE60A2D
Reporter abuse_ch
Tags:GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server.kibriswebtasarimi.com
Sending IP: 176.9.21.149
From: kavita_d@hindustancopper.com
Subject: CLARRIFICATION RFQ 13970 DT.02 / 03/2020 DUE DT.17 / 05/2020
Attachment: RFQ 13970 DTgz.gz (contains "RFQ 13970 DTgz.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1EI_VBo7HIIA8DaxPyBp0jfZRNgUIIu4l

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 16:36:54 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z5ievrhj64nnvmmmfctyos5bagxkvyjb3wdpoouovbizsup72bpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz cf504ac4e9f71adab18c28a7874ba101aeaae121dd86f73a8ea8519951ffd05f

(this sample)

GuLoader

Executable exe 7d90dd1c7420b9b1300ffc653c2465fa6c602f664b2cd0fdf1644a5cdef4954a

  
URLhaus
https://urlhaus.abuse.ch/url/379343/
  
Dropping
MD5 04982e327cd2f72bdd31efb1bb7a2b63
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7d90dd1c7420b9b1300ffc653c2465fa6c602f664b2cd0fdf1644a5cdef4954a

Comments