MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6f2ddb3eb2696dc88121f6cad6fce9c0b023d4aa1f8a31e912c7577b2e08e32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: d6f2ddb3eb2696dc88121f6cad6fce9c0b023d4aa1f8a31e912c7577b2e08e32
SHA1 hash: 56c9e77edbc6e0c59fca9ab1bec6a3b6b53515b9
MD5 hash: 1948787e848758aad4f5712626724c50
File name:Shipping advice.exe
Download: download sample
Signature GuLoader
File size:90'112 bytes
First seen:2020-05-22 09:55:07 UTC
Last seen:2020-05-22 10:52:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 60a96472cca422bab9aaa742e0402861
ssdeep 768:fSE/ccRzIR13ON2RaaK2agDbRwm4jp5DSXLZTJAF2UpttAah:KEbIr3O/z+b2m0pFSBUtA4
TLSH 90933C11B850DC66D9684EF76E39CED215AB7CB01E144B1B38C83B7C7A33942A92176F
Reporter @abuse_ch
Tags:exe GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: smtp1.hiworks.co.kr
Sending IP: 121.254.168.204
From: Seon Won <triangle@cnilogis.com>
Subject: Fw: Shipping advice
Attachment: Shipping advice.zip (contains "Shipping advice.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1Zkp6lYWfhKKaXXb76nvfWKLHBqPmer7C

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 23
Origin country FR FR
ClamAV SecuriteInfo.com.Trojan.DownLoader33.44564.15213.1861.UNOFFICIAL
VirusTotal:Virustotal results 24.66%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe d6f2ddb3eb2696dc88121f6cad6fce9c0b023d4aa1f8a31e912c7577b2e08e32

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments