MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec904b879d1d21ef741b6bb6ac6a557fcc75f6a10a49a8af9b70c9ae57b9b928. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec904b879d1d21ef741b6bb6ac6a557fcc75f6a10a49a8af9b70c9ae57b9b928
SHA3-384 hash: 72fa6ade6dc47578b7f657f6531ac72febdf4a6e0d5c823a7efc840a4dd8df5676f90b72423427dab8a65b6941bbd1ed
SHA1 hash: 6db6d5ecf52eb0ccd3f3e37eda3c7986c821e2f0
MD5 hash: ff70ec175dd562353bf2a425700dc470
humanhash: zebra-hot-oxygen-whiskey
File name:Requestion For Quotation.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:22'505 bytes
First seen:2020-05-03 12:36:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:Gl/iIJRAtD1RBzJ0IpuhM8X3O8r9WcMrbEpSDTEKcMubGq:cfRAtL0IpQM83O8rM5UcDTEKhrq
TLSH BCA2E145DE6DA32BD7FBC2726321A7C3CEADDD63192D18D72C849481242F28803CCE81
Reporter abuse_ch
Tags:GuLoader RAT RemcosRAT zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server240-2.web-hosting.com
Sending IP: 199.188.200.16
From: GM CEO<info@attachmentusercontent.com>
Reply-To: infoa6044@gmail.com
Subject: General Manager CEO Request For Quotation
Attachment: Requestion For Quotation.zip (contains "Requestion For Quotation.pif")

GuLoader pushing RemcosRAT

RemcosRAT payload URL:
https://mail-cloud.ngrok.io/bin/pounds-hopto_ngcXGkDrVs1.bin

RemcosRAT C2:
pounds.hopto.org:9115 (155.94.198.169)

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-03 13:35:25 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5siexb45duq665a3no3ky2svp7ghl5vbbje2rl43ode24v5zxeua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip ec904b879d1d21ef741b6bb6ac6a557fcc75f6a10a49a8af9b70c9ae57b9b928

(this sample)

GuLoader

Executable exe 9c2e8914a4d3511eaa2f69e6ab33c9ff7d760d4ebfb761b38ed56eed8fe32ddb

  
URLhaus
https://urlhaus.abuse.ch/url/356529/
  
Dropping
MD5 fa7d5cc0368a3c68397b1f86dc9d3ac4
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9c2e8914a4d3511eaa2f69e6ab33c9ff7d760d4ebfb761b38ed56eed8fe32ddb

Comments