MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d106f149f1605d6e64cf05b6d1208343cbf2f5a3491de4c6b05e12f77fa6ae31. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: d106f149f1605d6e64cf05b6d1208343cbf2f5a3491de4c6b05e12f77fa6ae31
SHA1 hash: 70eceaf6ee33dca04993c9d86c3ffb4b88775841
MD5 hash: f4e0049944ac03049e8a88113169fa2d
File name:0022-5-2020.exe
Download: download sample
Signature GuLoader
File size:94'208 bytes
First seen:2020-05-22 10:02:30 UTC
Last seen:2020-05-22 10:52:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7681e5f23cb1f62f50c723d91b30549f
ssdeep 768:kz3uH9zZfXx067RBSWlcrE/gMkScxRocXCN1taJxq7nkhpT8rTy8aS:s3md06eu/gMkSbDkbU1
TLSH EC933A61B4D4EEB2E6258FF609F58284156BFC3A1A044A1334CD3F2E253798EDA35357
Reporter @abuse_ch
Tags:exe GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: slot0.erageran.xyz
Sending IP: 45.95.169.208
From: Account <info@urommats.com>
Reply-To: mail.reply@mail.com
Subject: Bank in slip
Attachment: 0022-5-2020.zip (contains "0022-5-2020.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1I-57ktpnNKIvU_Gi8NknQLuujS5xXR0R

Intelligence


Mail intelligence
Trap location Impact
IT Italy Low
Global Low
# of uploads 2
# of downloads 26
Origin country US US
ClamAV PUA.Win.Packer.ProtectSharewar-2
PUA.Win.Packer.ProtectSharewar-3
VirusTotal:Virustotal results 15.28%
ReversingLabs :No data

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe d106f149f1605d6e64cf05b6d1208343cbf2f5a3491de4c6b05e12f77fa6ae31

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments