MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f421c6564e3f58386766e48d28e5f788369e82423e9619ff9775358884320d43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f421c6564e3f58386766e48d28e5f788369e82423e9619ff9775358884320d43
SHA3-384 hash: 44ae7997fa0068dd1ae1d98fda83de826cf598ff9521f95f632fe60ead3a9897d1b05a301cc97cb2f2673898a55731e9
SHA1 hash: 91d935e9ebf00e54b90c5810abcaa248299a4bf2
MD5 hash: 0b9bed151f052da8e4acab4761378864
humanhash: glucose-ten-chicken-oregon
File name:9287632_Invoice_confirmation.iso
Download: download sample
Signature GuLoader
Create hunting rule
File size:147'456 bytes
First seen:2021-01-14 06:57:33 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 1536:Pdx/JAHn5xNxqet9Tz0F1JmTPQnoY8QC2uyo:fUz00jQzXnBo
TLSH E9E3D765B254E6F1F60785BE36E4EE680C4B7B300B66C907F14D261D2BBB9CD8520B93
Reporter abuse_ch
Tags:GuLoader iso


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mjrkintu.com
Sending IP: 173.230.246.112
From: "Irene David" <rector@nyengaseminary.org>
Subject: Payment Confirmation..
Attachment: 9287632_Invoice_confirmation.iso (contains "9287632_Invoice_confirmation.exe")

GuLoader payload URL:
https://www.agamagroup.com.ng/ok/janomo_wFAvdBCiy248.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
201
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Bulz.302514.17205.23890.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f421c6564e3f58386766e48d28e5f788369e82423e9619ff9775358884320d43/
Threat name:
Win32.Trojan.Bulz
Create hunting rule
Status:
Malicious
First seen:
2021-01-14 06:58:10 UTC
AV detection:
9 of 45 (20.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6qq4mvsoh5mdqz3g4sgsrzpxra3j5asch2lbt74xou2yrbbsbvbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f421c6564e3f58386766e48d28e5f788369e82423e9619ff9775358884320d43

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso f421c6564e3f58386766e48d28e5f788369e82423e9619ff9775358884320d43

(this sample)

GuLoader

Executable exe e1c6e44bb03c1cdab3844b42f46634bd578f896373e9467ca2b8d092d047eb71

  
URLhaus
https://urlhaus.abuse.ch/url/959919/
  
Dropping
MD5 f09e137bc28b578f42cd15712558e69b
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e1c6e44bb03c1cdab3844b42f46634bd578f896373e9467ca2b8d092d047eb71

Comments