MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef5bf38b533e6b5c650782d9c28bf142a97f99cf6748f3bbce576c448bfe2b0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef5bf38b533e6b5c650782d9c28bf142a97f99cf6748f3bbce576c448bfe2b0c
SHA3-384 hash: aac7532be165fd4f647bf62d970cb330802c76b1b24f9410eadaf64f15224570c7c7a1ec1a0d9565ec74172fc8be8306
SHA1 hash: 2946526a95b80a4700449fa71f14af1801dcb7c6
MD5 hash: 91b962ebf4f334ca76fd3245f8a4607b
humanhash: music-seventeen-uniform-twenty
File name:Products_Order_pictures.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:58'515 bytes
First seen:2020-08-13 13:45:52 UTC
Last seen:2020-08-13 14:02:01 UTC
File type: rar
MIME type:application/x-rar
ssdeep 768:yO2/sfetHkD93Nmwcr2QHwG5vR8ct3sfDgeSCutwvAq/JWn56YnR6E6m6I4b8:gEfehkh3EwcBtvRdsXuuvv/4lRg3I4b8
TLSH EB4302231802DEAF5B7D6D1B630B44B9DBC9E9E00FA63C5278A3A9587072505853F1BD
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: hwsrv-761317.hostwindsdns.com
Sending IP: 104.168.173.112
From: info@ricksaezp.com
Reply-To: info@ricksaezp.com
Subject: Quote#CON-071720-EB
Attachment: Products_Order_pictures.rar (contains "Me.scr")

GuLoader payload URL:
https://onedrive.live.com/download?cid=7FED4FBEA32E3C1E&resid=7FED4FBEA32E3C1E%21107&authkey=AEoXfycPoLIFch0

Intelligence

File Origin
# of uploads :
2
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef5bf38b533e6b5c650782d9c28bf142a97f99cf6748f3bbce576c448bfe2b0c/
Threat name:
Win32.Trojan.Graftor
Create hunting rule
Status:
Suspicious
First seen:
2020-08-13 13:47:04 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=55n7hc2thzvvyzihqlm4fc7rikux7gopm5epho6ok5wejc76fmga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ef5bf38b533e6b5c650782d9c28bf142a97f99cf6748f3bbce576c448bfe2b0c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar ef5bf38b533e6b5c650782d9c28bf142a97f99cf6748f3bbce576c448bfe2b0c

(this sample)

GuLoader

Executable exe e6bdca558fb485e6ac7295d20f868902f2b790bc147fb3ab1e3a6628280d40f3

  
URLhaus
https://urlhaus.abuse.ch/url/431586/
  
Dropping
MD5 ee8ac2ac354aca32c315027e6fa69a64
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e6bdca558fb485e6ac7295d20f868902f2b790bc147fb3ab1e3a6628280d40f3
  
Dropping
SHA256 717ab569e1a4743ce73546e57a7a1f875425747672b5f2d6fce34af35ab8c16f
  
Dropping
MD5 0f0ea770d4c72ba678d510d91b86ab27

Comments