MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3c8542857ee981d43a1d7bf0def270b9822cf636e7167e880704c29fcc7c015. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f3c8542857ee981d43a1d7bf0def270b9822cf636e7167e880704c29fcc7c015
SHA3-384 hash: 14d9cd08d164ea4fb41644777773fe5dc374284ea1dcd79d3ca93d07c23ca290b78df9042a3268a991a132e06412ef64
SHA1 hash: 3bd5a388522524f1bbc26186fb758cecf5c3ab9e
MD5 hash: 966fb8383a7b594ba248c9878d0d062a
humanhash: lithium-fillet-massachusetts-lithium
File name:HT_20200526.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-26 07:50:59 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:3sYj60ol1GBmZMknBujFHxQgkHmkwNliYbf4K5P8kPTbR:3sC6OjFfh15bTd
TLSH 6045E72375D89DD2DC1C4EB288675A972E3AAD3075500F1B360DF69C67332CABAB4306
Reporter abuse_ch
Tags:geo GuLoader img KOR


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm82.hanmail.net
Sending IP: 211.231.106.157
From: 이한석 <woosin577@daum.net>
Subject: 긴급 견적의뢰
Attachment: HT_20200526.IMG (contains "HT_20200526.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1uF_4zr5Qc5RfxwI1qstwUifJIVF1XvAV

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis0E57742D4E8E.29732.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 08:37:14 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img f3c8542857ee981d43a1d7bf0def270b9822cf636e7167e880704c29fcc7c015

(this sample)

GuLoader

Executable exe 26ce0c918ef0af5c3883abee1079fe40ee2d028d05703918266680ee5d7b9508

  
URLhaus
https://urlhaus.abuse.ch/url/368638/
  
Dropping
MD5 0e57742d4e8e9fd07c639dd81a6fc5c2
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 26ce0c918ef0af5c3883abee1079fe40ee2d028d05703918266680ee5d7b9508

Comments