MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d62ed8a89249a86ebc5e9bd4a5395813be5470ba726c0e90c610de70bdf9dea6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d62ed8a89249a86ebc5e9bd4a5395813be5470ba726c0e90c610de70bdf9dea6
SHA3-384 hash: f59a917cf9008c569fe8f6dbf7015e9ed05df12726d2cd76e42c4fc917d32f71d3a465a447c32c8ee5f5695b82784473
SHA1 hash: 53f7b7d0b2bf7c60d13e938d63a473ecca82b7a3
MD5 hash: e19c1f42dbf2dfaae128171baaf2e2a8
humanhash: muppet-lion-nuts-fillet
File name:Invoice.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:27'756 bytes
First seen:2020-06-02 11:25:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:NDw0Jm/JX56lA3KQYtkXn/RgSwtfDEJ5T1jhgZ5gD:NDw0OHSSmoTViXgD
TLSH 60C2E15F04BAE940FBA199B1FE50FDC0DBD9D13E9491A578D8CB64CC9C42488F409DC2
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: park-mx.above.com
Sending IP: 103.224.212.34
From: vi.dell@fvb.de
Subject: Re: New order
Attachment: Invoice.zip (contains "Invoice.exe")

GuLoader payload URL:
http://156.96.118.179/AWELE-RAW_GTWfCx233.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25244.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21103.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Grp
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 11:37:44 UTC
AV detection:
30 of 47 (63.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2yxnrkesjgug5pc6tpkkkokyco7fi4f2ojwa5eggcdphbppz32ta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip d62ed8a89249a86ebc5e9bd4a5395813be5470ba726c0e90c610de70bdf9dea6

(this sample)

GuLoader

Executable exe 05a1356768e4475daeebaae76e486705d2d920e7e4d511c1436ea3f9a650c1df

  
URLhaus
https://urlhaus.abuse.ch/url/369174/
  
Dropping
MD5 5aa329e53d45ac16f58fca9373554169
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 05a1356768e4475daeebaae76e486705d2d920e7e4d511c1436ea3f9a650c1df

Comments