MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc7ef57702ca397a5696ad9fbebccf153a9574f39e538e667e5cef7e957c8988. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc7ef57702ca397a5696ad9fbebccf153a9574f39e538e667e5cef7e957c8988
SHA3-384 hash: ae9be60d333b9aacf864485ff7971dcaf4d1cfb6e69f0d80c35dd52a48829cf7bbefe73fda9803b46c6dd9d079ddcdd1
SHA1 hash: 1c56d44951370eafe6dc959d8e97f3a494016a02
MD5 hash: 0e9e0dbcc73118f1d0a7cd6c32260bc0
humanhash: papa-colorado-august-hawaii
File name:Product Catalogue.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:88'433 bytes
First seen:2020-06-05 13:41:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:TCyyEQzQiijMc7cVmfpTAU0ugMkdWcSVEwsC+al7e1juiSCk7L/u0hlVixTH7:qQCGcVu2BdIV3Re1aiSCk7LX05
TLSH 748312F49A230828E2D9AE7ED0DC5C9A400D96F1B7490B79B7E804E1F23D56748E52FD
Reporter abuse_ch
Tags:CHN geo GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: capitalhillfg.pw
Sending IP: 194.87.190.70
From: Mitali Shah <Mitali@capitalhillfg.pw>
Subject: 新訂單通知
Attachment: Product Catalogue.zip (contains "Catalogue.exe")

GuLoader payload URL:
http://194.87.190.89/111.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Guloader-8002906-0
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 09:26:40 UTC
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3r7pk5yczi4xuvuwvwp35pgpcu5jk5httzjy4zt6ltxx5fl4rgea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip dc7ef57702ca397a5696ad9fbebccf153a9574f39e538e667e5cef7e957c8988

(this sample)

GuLoader

Executable exe d7e975690cea31ddff67f92f89ee45cf24f09d9e3f7e91b8f3ee6305d23e52d5

  
URLhaus
https://urlhaus.abuse.ch/url/382089/
  
Dropping
MD5 0281699d16d6466c44df867bc0009d56
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d7e975690cea31ddff67f92f89ee45cf24f09d9e3f7e91b8f3ee6305d23e52d5

Comments