MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec56447670ee198da665c91a2f39ed7a8e8b94e1bf013c4932bae528de097f4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec56447670ee198da665c91a2f39ed7a8e8b94e1bf013c4932bae528de097f4f
SHA3-384 hash: 513820c55e6bd5fb3130b45604bed7568710772e3871c12ed78cadb55bdb6cd9b1db5b176119c0bcc977c3d2b21bedc9
SHA1 hash: 8dae6f5eee8e25a6748a284ab6e17dfe3529bf0c
MD5 hash: afd39aa30b5ab0735e339f8820eb0e46
humanhash: mango-monkey-robin-ohio
File name:Documents-DHL950446602.pdf.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:29'357 bytes
First seen:2020-05-27 18:27:23 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 768:6l0oCMp1DWC5oES5842fr3DYlcuw74lL2/aFFp:6lzbp1DWCCy3DCcuHly/qFp
TLSH 13D2E1388D193C84E152DF2B9A7994B04F6D0CCEB66DC3E8E495D372886FA4CD64F442
Reporter abuse_ch
Tags:GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: aa98419.online-server.cloud
Sending IP: 74.208.129.40
From: billing <billing.expressec@dhl.com>
Subject: New Shipment Documents-DHL950446602
Attachment: Documents-DHL950446602.pdf.gz (contains "Documents-DHL950446602.pdf.bat")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1akrH7KG0l3hn58xmNe8ci1kR2ehTlGaP

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 18:37:49 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz ec56447670ee198da665c91a2f39ed7a8e8b94e1bf013c4932bae528de097f4f

(this sample)

GuLoader

Executable exe 71c480037054788a2dfd0b0b0c711cfb03faf7ee4fc34049b30fa2738cdd2610

  
URLhaus
https://urlhaus.abuse.ch/url/369998/
  
Dropping
MD5 89125b70f3266c265c7ce5ab20f211b5
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 71c480037054788a2dfd0b0b0c711cfb03faf7ee4fc34049b30fa2738cdd2610

Comments