MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e92a53b58d74af353308e60b86088144b6db3fe053e05cdae8d5844fd715aae0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e92a53b58d74af353308e60b86088144b6db3fe053e05cdae8d5844fd715aae0
SHA3-384 hash: 64f652d4a4f4290dee11008dcd00721a73a2aa1342b338c93a82844a653753dbe54e8dc2a37587f2394f63111af3ab18
SHA1 hash: 891346fd792646ad0565345692ba0d349f61289b
MD5 hash: 7074163f3c9a45a9dc9152c1eacdb370
humanhash: fish-nitrogen-may-low
File name:PO-Doc_094930069577IMG.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:167'936 bytes
First seen:2020-05-28 13:15:24 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:+ENnpoEYV7Uu1SVkqaF5lQ5zrAj8e5jAAhQfU8qpNjrIRI2KQ:+On+USSVk7+5HZe5jAAhQfUOR
TLSH 55F3E623AA50EB11D43085F169074B9C156BBE3101E2495BB5CD2B5B3BB3EA3F96C34B
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: bestrade.com.tr
Sending IP: 45.147.228.215
From: Hatice Merve <merve@bestrade.com.tr>
Subject: RE: Urgent Request Quotation(New Contqact)
Attachment: PO-Doc_094930069577IMG.img (contains "PO-Doc_094930069577IMG.com")

GuLoader payload URL:
https://onedrive.live.com/download?cid=4680A2A320AEF80E&resid=4680A2A320AEF80E%21106&authkey=AHwQb5EDmzPsQis

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Kryptik.HDRJ.17294.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 13:38:19 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
2 of 48 (4.17%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img e92a53b58d74af353308e60b86088144b6db3fe053e05cdae8d5844fd715aae0

(this sample)

GuLoader

Executable exe fd347554330fc464c7bd650aedc8d722bfa697fd1bb98fe74b752e41c7fc97dc

  
URLhaus
https://urlhaus.abuse.ch/url/371070/
  
Dropping
MD5 0b8588ff2e04731754ff08b145dc4605
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fd347554330fc464c7bd650aedc8d722bfa697fd1bb98fe74b752e41c7fc97dc

Comments