MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec5806d3e6435c2f3fdedfce263190c0a0f95280bbac41393f22206b151d5d4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec5806d3e6435c2f3fdedfce263190c0a0f95280bbac41393f22206b151d5d4f
SHA3-384 hash: f8593296674ca2155e24cf367012a7ff635df15342caaecae9cdb272c6d62bde6bf398106b74608207bdc09394ee6d7d
SHA1 hash: a7b6bcf2f0f072adbf24572b828f337f9a7bbd63
MD5 hash: e609725b2b81e43b56c3dc34726b8c74
humanhash: quiet-quiet-two-four
File name:Statement of account.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:25'531 bytes
First seen:2020-05-12 16:20:48 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:Sas+l2F7vJykhxMx9LvC7M0YSlkT/GhiLlwR+Y1H:Sas+UF7dh6MHk1wF
TLSH 29B2E1FC566D11D6B17611B13D393EE33A15413D8F15A0BAB4B8F3DC48429842BAAB4D
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: api.cernate.com
Sending IP: 5.249.154.41
From: Sales <sales@cernate.com>
Subject: Re:updated statement of account
Attachment: Statement of account.zip (contains "mr sky.bat")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.FareitVB-AB.28242.2833.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 16:37:13 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5rmanu7ginoc6p6637hcmmmqycqpsuuaxowecoj7eiqgwfi5lvhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip ec5806d3e6435c2f3fdedfce263190c0a0f95280bbac41393f22206b151d5d4f

(this sample)

GuLoader

Executable exe 7cc0c6e489cb1b2d1dae70339b9409f9a54fa7d8920430490663b6f28ea4a7b4

  
Dropping
MD5 36428a2df475d4222ad0358f6c547603
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7cc0c6e489cb1b2d1dae70339b9409f9a54fa7d8920430490663b6f28ea4a7b4

Comments