MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d305f9854610158f54bc75d261ebd46ce02207c02fbe0b66df04765c7282b842. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d305f9854610158f54bc75d261ebd46ce02207c02fbe0b66df04765c7282b842
SHA3-384 hash: 6bec696ac246a7ea0e568d5b8ecf6c01671b5d70b8df05f080c19121473d3343aee72f87ab84fa780be5f1925557b52d
SHA1 hash: 7fab73f571dd072a03400dc2173aa4b1645cc70b
MD5 hash: d6c4fa690fadc34aa16433ec1abe8ab7
humanhash: iowa-louisiana-wolfram-xray
File name:Rechnung.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:105'471 bytes
First seen:2020-06-02 16:01:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:RhWJuAC+HJmZmmEn80DrO4ZbLmi79T7VqVMuZli3M4srVQkq/vSFuYRq15WocD+B:RhP8mZCnnF7VViriM4PkqykYqYD+QTpE
TLSH 3CA3123DCAFF8EB8E14AF64F25CB05D586B7288750C14AED6F824C6381EEC456322795
Reporter abuse_ch
Tags:DEU geo GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: CEN-YCO-Rutalia-003.hispaweb.net
Sending IP: 109.70.131.174
From: Dr. Chris Jones <drchris-jones@outlook.com>
Reply-To: chris-jones@joneschris.tech
Subject: AW: AW: Zahlungsbeleg und Auftragsbestätigung 2-06-20 Rechnung_20-613129926-001
Attachment: Rechnung.zip (contains "rechnung.exe")

GuLoader payload URL:
http://156.96.118.179/slxslx-2RAW_gwKBF147.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
MiscreantPunch.SingleXOR.EXE.197.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23811.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Virus.Floxif
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 16:36:07 UTC
AV detection:
37 of 48 (77.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2mc7tbkgcaky6vf4oxjgd26untqceb6af67awzw7ar3fy4ucxbba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip d305f9854610158f54bc75d261ebd46ce02207c02fbe0b66df04765c7282b842

(this sample)

GuLoader

Executable exe a8c03f50ff8217b8e4fe7e650360a566003875d0a943af2f2b3b895908872e4a

  
URLhaus
https://urlhaus.abuse.ch/url/374619/
  
Dropping
MD5 dddfc5bf7599ae2aacd87640404f585d
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a8c03f50ff8217b8e4fe7e650360a566003875d0a943af2f2b3b895908872e4a

Comments