MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f62778e900834799841da7d31b6f38d6908d9ac5a14a44d6d1a0abfcb8012990. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f62778e900834799841da7d31b6f38d6908d9ac5a14a44d6d1a0abfcb8012990
SHA3-384 hash: e69a3ffd5a4c212d40b07a8bf2ede1faffd0e0718578407473102130d8c9d3ca25afcb347019f49e1c3856ea4f270f5c
SHA1 hash: 0a7b945e8d2bd98c4de78b31ead1a2a13ee5a765
MD5 hash: 3ebc0df2343a1fafffb9e2ddce7256b8
humanhash: butter-lemon-eight-chicken
File name:New bank details.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-27 12:50:33 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:uJ7KWCzUaPOQvn2VDph+NT3mIfOrMaWFkJU3yLa:uZK3xPOQf2+NTFf2M4SCLa
TLSH 5845160B75C86C72E9398BB119B285A25D36FC253D004B2B710CBB2DAF775D928E075A
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: nsmail.psa.gov.ph
Sending IP: 202.78.94.66
From: Vaghela Anil <purchase@dhcubeindustries.in>
Subject: PLEASE CONFIRM ACCOUNT
Attachment: New bank details.img (contains "dombogac.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=F5533CD060D35070&resid=F5533CD060D35070%21161&authkey=ALKFxCxSEnXaqAc

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.KillProc2.10682.5749.23985.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 13:36:17 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
14 of 30 (46.67%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img f62778e900834799841da7d31b6f38d6908d9ac5a14a44d6d1a0abfcb8012990

(this sample)

GuLoader

Executable exe 348ad616b802594ef5f77160bdf21fbe5b806e6400c2ad4cedc019bc25374e61

  
Dropping
MD5 249f7d2d22169497d97e5cc42351ee51
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 348ad616b802594ef5f77160bdf21fbe5b806e6400c2ad4cedc019bc25374e61

Comments