MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb1fb9a0ac06d253860caa40bc7af8b1c126463446f14312b7ce79a20efa1d8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb1fb9a0ac06d253860caa40bc7af8b1c126463446f14312b7ce79a20efa1d8c
SHA3-384 hash: ca92a44a2f2773028968405705f80c4db2d2684176df9f3c0c3c2227e9154eba70e37cdbc2d1c318f70dcb68005dc692
SHA1 hash: 03e6f6823afbe3e7eccae4ad1b95f3e7cd0e48f8
MD5 hash: 63cf46c06a2819b51cab0703ed8a5dd3
humanhash: summer-violet-kitten-sink
File name:shipping doc _pdf.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:350'590 bytes
First seen:2020-05-01 17:35:35 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:H+IEVHMllBTg0LXFoanlsPF3pSQIZUrWUCPwxbAOX2mWqik/htSF:HOV7gXlnl5DyF5ZX+ql/8
TLSH CC7423B16DFDB7AC7EAC133092B3D628319B851F651D5D0BA40432417FF29FA8B8A854
Reporter abuse_ch
Tags:DHL GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: qproxy6-pub.mail.unifiedlayer.com
Sending IP: 69.89.23.12
From: DHL Express || Logistic Partner <custormerservice@dhl.com>
Subject: DHL Express - E-Way Bill Report
Attachment: shipping doc _pdf.gz (contains "shipping doc _pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48211.2988.1470.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 18:35:39 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7mp3tifma3jfhbqmvjaly6xywhasmrrui3yugevxzz42edx2dwga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz fb1fb9a0ac06d253860caa40bc7af8b1c126463446f14312b7ce79a20efa1d8c

(this sample)

GuLoader

Executable exe f9eb36080d1ab8f016ff0f132add3bd220f01fe6220c9ce3ef554e98318bd33a

  
Dropping
MD5 40fb6611e5d9eae0dcb4311d37a539b2
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f9eb36080d1ab8f016ff0f132add3bd220f01fe6220c9ce3ef554e98318bd33a

Comments