MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db27d3a9c83aea367407c6f63490c341076deea3e7fdd07d0585b4af86bd8681. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db27d3a9c83aea367407c6f63490c341076deea3e7fdd07d0585b4af86bd8681
SHA3-384 hash: 7b88d8d25615af9657109f5c7c9fc671c8fd63bda12538ee43aa7367f15a9bde6773374820ace223fb4eca4d52bee9ab
SHA1 hash: 2a5447b27725e815f189cbcbcedae34325632804
MD5 hash: b6e3ff63e92589da9759f60fc08e2355
humanhash: oscar-ink-mockingbird-oregon
File name:Attached Purchase Order_zip.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:41'940 bytes
First seen:2020-06-09 06:40:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:Q3nNMf3S9pfXSy9N00R9aryiPAz1FJAOTTa0IKWhc89klY5FaFyG:yMWVCy9+0RAmcitnap1c8+lY5gJ
TLSH 3013F18AFD4FC7994468F53A3BF189758BE2E7E7842809DA1DC7F1D608D28B4D60058E
Reporter abuse_ch
Tags:arj GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: upg.adnslhosting.com
Sending IP: 198.15.82.214
From: Leona H. Osman <order@jeanplastllc.com>
Subject: Request For Quotation/PI
Attachment: Attached Purchase Order_zip.arj (contains "Attached Purchase Order_pdf.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=182eOoML0mqcuufRy6ySXIzBDF0h0KJ4j

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 04:19:59 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3mt5hkoihlvdm5ahy33djegdiedw33vd4765a7ifqw2k7bv5q2aq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip db27d3a9c83aea367407c6f63490c341076deea3e7fdd07d0585b4af86bd8681

(this sample)

GuLoader

Executable exe 5f0c0c43a813132bc787e581c5456b0bbd3f4bb1947691b9636eec6236861f5c

  
URLhaus
https://urlhaus.abuse.ch/url/384282/
  
Dropping
MD5 9d438023bfac0118348bf354b1761440
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5f0c0c43a813132bc787e581c5456b0bbd3f4bb1947691b9636eec6236861f5c

Comments