MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d287556cdf81a0164be5a8690a7b71206533e9d6287da1aeac1238832b4de38e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d287556cdf81a0164be5a8690a7b71206533e9d6287da1aeac1238832b4de38e
SHA3-384 hash: eb9c63110644ba2c8e9ea177c3bc07c5c6c0b196ef5ab1f4ef32a6da809318691e6610ff10fb4659885d1f3684ce5062
SHA1 hash: 045b90daa877a13d1a7d54ae8fe5792979c9a6e0
MD5 hash: 8421237a4a900bb67fae6ba1849c8287
humanhash: mars-freddie-diet-autumn
File name:Bank Payment Details.7z
Download: download sample
Signature GuLoader
Create hunting rule
File size:21'720 bytes
First seen:2020-08-12 06:37:34 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 384:U9hHEoK8vsEedbNKEfAeKFA9OkAelKHYMq7VGiwYmY2SgWCVM4xp92C1Wx+:ChHEo7sEekeSkgeIHYjVGibmbSgrM4xT
TLSH AEA2E1BDAE26C0FC085E404575C8EF84335919397E7189C64DB58451D2F329687C5F77
Reporter abuse_ch
Tags:7z GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: msr13.hinet.net
Sending IP: 168.95.4.113
From: sales.br@marel.com
Subject: Error in PAYMENT DETAILS . PLS CHECK NOW
Attachment: Bank Payment Details.7z (contains "Bank Payment Details.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1tgfsKIR7m1jSEhfvgjjR3D9WR3iqrJE7

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d287556cdf81a0164be5a8690a7b71206533e9d6287da1aeac1238832b4de38e/
Threat name:
Win32.Trojan.Graftor
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 06:39:08 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2kdvk3g7qgqbms7fvbuqu63rebsth2owfb62dlvmci4igk2n4oha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d287556cdf81a0164be5a8690a7b71206533e9d6287da1aeac1238832b4de38e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

7z d287556cdf81a0164be5a8690a7b71206533e9d6287da1aeac1238832b4de38e

(this sample)

GuLoader

Executable exe fee0d04292d5bb7b74e3fdfba682f02302c70ffcbc69a7d572fa9e190a683e64

  
URLhaus
https://urlhaus.abuse.ch/url/429872/
  
Dropping
MD5 e33c0dd8cefda67b901c37aeca4b5f2f
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fee0d04292d5bb7b74e3fdfba682f02302c70ffcbc69a7d572fa9e190a683e64

Comments