MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0326733a352a5c5b21489ce5b2e21ace51437473b5b2c1504247c7610602f03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d0326733a352a5c5b21489ce5b2e21ace51437473b5b2c1504247c7610602f03
SHA3-384 hash: d4b4c76a13819d45cfdacf5f65e9c0189b6bc617b5ac46695b65cec6850accc0cd7e24e8d6438921a4164f2e190ef3ac
SHA1 hash: e0a25c9155f8d07c4caf51426a499a5af8907d38
MD5 hash: d0173ee18ec809226717a22e511a2650
humanhash: coffee-bluebird-table-lamp
File name:CLOSE DOWN ORDER FROM CDC DATED 4.1.2020.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:25'728 bytes
First seen:2020-04-07 19:29:18 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 384:QM77GAyvcRzecdY5/RwlbqRqNj2bUYdFUBonEV765ER/wu:TnRrY/Reb5Nj2bXg2nwuk//
TLSH EBC2E14680F5A616FAF731709E84F08DD84AA69734B71E7D185F6E293809384B0BD9E1
Reporter abuse_ch
Tags:arj COVID-19 GuLoader


Avatar
abuse_ch
COVID-19 themed malspam:

HELO: 162-241-214-72.unifiedlayer.com
Sending IP: 162.241.214.72
From: HR Department <HR@victim-domain>
Subject: (UPDATE COVID-19) CLOSE DOWN ORDER FROM CDC DATED 4.1.2020
Attachment: CLOSE DOWN ORDER FROM CDC DATED 4.1.2020.arj (contains "CLOSE DOWN ORDER FROM CDC DATED 4.1.2020.bat")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Minix
Create hunting rule
Status:
Malicious
First seen:
2020-04-07 19:37:59 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
15 of 47 (31.91%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2azgom5dkks4lmqurhhfwlrbvtsrin2hhnnsyfieer6hmedaf4bq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

arj d0326733a352a5c5b21489ce5b2e21ace51437473b5b2c1504247c7610602f03

(this sample)

AgentTesla

Executable exe 50762c245b64ddede69fe5db39aec6c4c31bbb18520c6696368aa39ddea03006

GuLoader

Executable exe 5b89ef6de88e2a69a5f1f10d4a1ffcdb5a7562d184ff60162687f0e4d844f75f

  
Dropping
MD5 2e08c934e492a926b65301259bf60e17
  
Dropping
SHA256 5b89ef6de88e2a69a5f1f10d4a1ffcdb5a7562d184ff60162687f0e4d844f75f
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5b89ef6de88e2a69a5f1f10d4a1ffcdb5a7562d184ff60162687f0e4d844f75f

Comments