MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9bcebb30731ce1c7ecca26eb2d6a717caf06824fd834775e571d4f684f9d279. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 4 Yara Comments

SHA256 hash: e9bcebb30731ce1c7ecca26eb2d6a717caf06824fd834775e571d4f684f9d279
SHA1 hash: 97a094302b8da0699911f0d94a14414ae962d843
MD5 hash: e122989da5dd2b217b17195ab0cba9fd
File name:rechnung.exe
Download: download sample
Signature GuLoader
File size:94'208 bytes
First seen:2020-05-22 10:19:29 UTC
Last seen:2020-05-22 10:52:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 90271a1fd2a22e1377eab594fb8dfe81
ssdeep 768:FDYkfty2FBy2z+pyzLq3mvoUUfmjpCw8f0oK/P1kpVTrZEoIDrV//:JYSDFA2z+pyzLq39UUf6pCwzQuoYt
TLSH 15931A227E85D8B7DE008DB15956959D22FBBC3179800F0B78C53E1D3DF3A82B961B29
Reporter @abuse_ch
Tags:DEU exe geo GuLoader

Malspam distributing GuLoader:

Sending IP:
From: <>
Reply-To: <>
Subject: AW: AW: Zahlungsbeleg und Auftragsbestätigung 21-05-20 Rechnung_20-613129926-001
Attachment: (contains "rechnung.exe")

GuLoader payload URL:


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 26
Origin country FR FR
VirusTotal:Virustotal results 30.56%
ReversingLabs :No data

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe e9bcebb30731ce1c7ecca26eb2d6a717caf06824fd834775e571d4f684f9d279

(this sample)

Delivery method
Distributed via e-mail attachment