MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d54354282b36e9c23585eb9b2e7ab0b513500c3e2651d5e23cdfd55c4b11df00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d54354282b36e9c23585eb9b2e7ab0b513500c3e2651d5e23cdfd55c4b11df00
SHA3-384 hash: bda231629235ca18e234a15ee0acb05a1aa5703750cdf68befb82cc1077393b7debf4868da40ba55ed869911d1b2ae85
SHA1 hash: 927ba507a955cd770b0174ca7a85f43a168f4467
MD5 hash: efc51289819d5ef84f155dd65f0efd63
humanhash: tennis-monkey-delaware-violet
File name:FACTURA.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:40'529 bytes
First seen:2021-09-28 06:29:35 UTC
Last seen:2021-09-29 06:27:27 UTC
File type: rar
MIME type:application/x-rar
ssdeep 768:H4Iy01r5GbpDuIB5ojIRO+bMFN4BPje6FlXUR5Jtg5T0wsGPfHnRrhP:H4h01r5U1u6Y8lMFN4BPjeMURCT0VGnT
TLSH T1CC03F1B1BE9C01878A39D089DBF214D340F2FAAB71426D3EDD98082D16CE95197D97A2
Reporter cocaman
Tags:GuLoader rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Bankia Caixabank <bankia_caixabank@bankia.com>" (likely spoofed)
Received: "from dns135202.phdns18.es (dns135202.phdns18.es [154.56.135.202]) "
Date: "Tue, 28 Sep 2021 01:15:37 -0700"
Subject: "PAGO/S BANKIA CONFIRMING"
Attachment: "FACTURA.rar"

Intelligence

File Origin
# of uploads :
4
# of downloads :
151
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.23915.9051.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d54354282b36e9c23585eb9b2e7ab0b513500c3e2651d5e23cdfd55c4b11df00/
Threat name:
Win32.Trojan.Mucc
Create hunting rule
Status:
Malicious
First seen:
2021-09-28 06:30:09 UTC
AV detection:
9 of 45 (20.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2vbvikblg3u4enmf5ons46vqwujvadb6ezi5lyr437kvysyr34aa._file
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader downloader
Link:
https://tria.ge/reports/210928-g9ht2aahb4/
Behaviour
Suspicious use of SetWindowsHookEx
Guloader,Cloudeye
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d54354282b36e9c23585eb9b2e7ab0b513500c3e2651d5e23cdfd55c4b11df00

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar d54354282b36e9c23585eb9b2e7ab0b513500c3e2651d5e23cdfd55c4b11df00

(this sample)

GuLoader

Executable exe 7194eca2c497f9ea9c3bb989fb7f328d9740b6d396af39ec66ec730c0db61044

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7194eca2c497f9ea9c3bb989fb7f328d9740b6d396af39ec66ec730c0db61044
  
Dropping
GuLoader

Comments