MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9bcebb30731ce1c7ecca26eb2d6a717caf06824fd834775e571d4f684f9d279. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: e9bcebb30731ce1c7ecca26eb2d6a717caf06824fd834775e571d4f684f9d279
SHA1 hash: 97a094302b8da0699911f0d94a14414ae962d843
MD5 hash: e122989da5dd2b217b17195ab0cba9fd
File name:rechnung.exe
Download: download sample
Signature GuLoader
File size:94'208 bytes
First seen:2020-05-22 10:19:29 UTC
Last seen:2020-05-22 10:52:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 90271a1fd2a22e1377eab594fb8dfe81
ssdeep 768:FDYkfty2FBy2z+pyzLq3mvoUUfmjpCw8f0oK/P1kpVTrZEoIDrV//:JYSDFA2z+pyzLq39UUf6pCwzQuoYt
TLSH 15931A227E85D8B7DE008DB15956959D22FBBC3179800F0B78C53E1D3DF3A82B961B29
Reporter @abuse_ch
Tags:DEU exe geo GuLoader


Twitter
@abuse_ch
Malspam distributing GuLoader:

HELO: mxout02do.versatel.de
Sending IP: 89.245.129.165
From: kidrth@versanet.de <kidrth@versanet.de>
Reply-To: kidrth@versanet.de <kidrth@versanet.de>
Subject: AW: AW: Zahlungsbeleg und Auftragsbestätigung 21-05-20 Rechnung_20-613129926-001
Attachment: Rechnung1.zip (contains "rechnung.exe")

GuLoader payload URL:
http://156.96.118.179/RSol.bin

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 26
Origin country FR FR
ClamAV SecuriteInfo.com.Variant.Ursu.878098.14188.9359.UNOFFICIAL
VirusTotal:Virustotal results 30.56%
ReversingLabs :No data

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe e9bcebb30731ce1c7ecca26eb2d6a717caf06824fd834775e571d4f684f9d279

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments