MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb673a274aacc93fe7c20970e3709e2eead3dc8e4edeb73f5c607dd38a64ef87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb673a274aacc93fe7c20970e3709e2eead3dc8e4edeb73f5c607dd38a64ef87
SHA3-384 hash: 726ce1c9271fa768e9d376c4366e2a740a57f9716395a3ac00e00ce41c7b05c7518d9c85c47f045352e0d16055e0afce
SHA1 hash: 77eea23fce5ed9e301c2ed6579c750830303ad62
MD5 hash: bc914243ecf18f41d44ac7c8296288bc
humanhash: maine-magazine-kitten-berlin
File name:BL_ETA-208324A,XLS.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:283'030 bytes
First seen:2020-05-12 16:18:38 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:THNZpLxPjCMKUM9IrZYO/m5FElSk+X8DGTiD+TWVTbS9rp:RdjT4iYmsSYk+X8DZRlSRp
TLSH 4D5423CE9FDBF1CD8286A0C9581DF538C86A22A23D5F7351198C8E9D3D043DDAC129E6
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: cathay-food.co
Sending IP: 111.90.140.123
From: Mask Line <thico@ms10.hinet.net>
Reply-To: thico@ms10.hinet.net
Subject: RE: FW: SHIPMENT ADVISE
Attachment: BL_ETA-208324A,XLS.rar (contains "BL_ETA-208324A,XLS.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 16:37:14 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5nttuj2kvtet7z6cbfyog4e6f3vnhxeoj3plop24mb65hcte56dq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar eb673a274aacc93fe7c20970e3709e2eead3dc8e4edeb73f5c607dd38a64ef87

(this sample)

GuLoader

Executable exe 968caaf20d88166fb2ea2774f772f36a4f070bd6d912f8a1c46c0ae4cd3a31a7

  
Dropping
MD5 f8a26a984c69fa57f2390bbbd7fb6c5f
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 968caaf20d88166fb2ea2774f772f36a4f070bd6d912f8a1c46c0ae4cd3a31a7

Comments