MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fae852c530bcfab191c58f0ba277b008449ecd446c0c117af8b905d852474c03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fae852c530bcfab191c58f0ba277b008449ecd446c0c117af8b905d852474c03
SHA3-384 hash: b54963e2446f1ac1579f6fcc2edb0521c040781b57a721797ae2a48d0f1a9f31b1b8b11bd2673d7a8830f88fb1f9e029
SHA1 hash: 7a5a593e66ed81d3b6fbbe9716811a6e47a39865
MD5 hash: 791984179ea81bbb0308c798dd0e8d01
humanhash: fanta-rugby-hamper-single
File name:Bank Details.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:35'316 bytes
First seen:2020-06-02 11:16:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:9OCZr5qxh8D/jxMVMp7R4Yr0MePNQ4UzIvAVDMOngD:9xrwMDLxMVMz77elQ4UzIvAVE
TLSH 7EF2F1A03D1E404013B59298B52F1CF91A587C6FE63E63E6F1CE48EC18ACD97E6D26D4
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

From: "Li Yung" <managersales64@gmail.com>
Reply-To: managersales64@gmail.com
Subject: Re: Bank Details
Attachment: Bank Details.rar (contains "Umpyafleve.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=15ZK6yZNzPxrs70VlDvZ-gFkoT8oxKVpO

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Occamy
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 11:37:52 UTC
AV detection:
15 of 47 (31.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7luffrjqxt5ldeofr4f2e55qbbcj5tkenqgbc6xyxec5qushjqbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar fae852c530bcfab191c58f0ba277b008449ecd446c0c117af8b905d852474c03

(this sample)

GuLoader

Executable exe d9b7293da93fe26342d47b1f00180746b3ee0ca251965e199996ad38c82fa422

  
URLhaus
https://urlhaus.abuse.ch/url/373380/
  
Dropping
MD5 96023469c2587c36ff3811b0d9103abd
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d9b7293da93fe26342d47b1f00180746b3ee0ca251965e199996ad38c82fa422

Comments