MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d45cb0cc3ad0cf6ffe10da946aa402b9e227fb0ac2a989e37904c8626c34c2c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 5 Yara Comments

SHA256 hash: d45cb0cc3ad0cf6ffe10da946aa402b9e227fb0ac2a989e37904c8626c34c2c0
SHA1 hash: 2071d7ef2367afc7b4d56ba805016d8be9246e53
MD5 hash: 35029684e39cf6975e9f1345ea9f6b7f
File name:SWIFT TRANSFER COPY.pdf.r07
Download: download sample
Signature GuLoader
File size:24'172 bytes
First seen:2020-05-22 15:04:44 UTC
Last seen:Never
File type: r07
MIME type:application/x-rar
ssdeep 384:HR7qiUg1j/haUeON485wPOQvWHbl3Bi/RaXq+kbjSzlVqZzgJifPLQ3JW1:HROiUUrhjeON48imQ+p3BYRaDkHGlwqK
TLSH 7BB2D1DE38B4780F24593F8A4807AF33CEAD2CA95175B9FBD52ADE9614200B18D43D6D
Reporter @abuse_ch
Tags:GuLoader r07


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: pro03.emailserver.vn
Sending IP: 103.15.48.223
From: ACCOUNTING <kt_1@achison.com>
Subject: RE: Payment Receipt
Attachment: SWIFT TRANSFER COPY.pdf.r07 (contains "SWIFT TRANSFER COPY.pdf.bat")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1zpSdW4Tji4URCA69dGKz-v62r_7LJazk

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 22
Origin country US US
ClamAV No detection
VirusTotal:Virustotal results 16.39%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

r07 d45cb0cc3ad0cf6ffe10da946aa402b9e227fb0ac2a989e37904c8626c34c2c0

(this sample)

  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment

Comments