MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fead839de354358b35134d26134afbf69e552de524574e73f0816e969b7d3437. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fead839de354358b35134d26134afbf69e552de524574e73f0816e969b7d3437
SHA3-384 hash: 400f9443063c3eb9e2b97713d15c6029d3cf34a02287878f5933c55bc8bce09dfcd870d902194f4dace0252d37df626e
SHA1 hash: 30beeed3d66a03e705b6d2b36ed9280d48ff9074
MD5 hash: 65bdefca5f49100572d1ff93ee2f020e
humanhash: fillet-bluebird-fourteen-juliet
File name:Payment Slip_pdf.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:22'076 bytes
First seen:2020-04-27 05:39:25 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:lxL4gd+o6zfpv1fUUA3tzhSO6w3Gc+wOWUEi7trjzvTn8bPHoaP90yn2GO5jnILe:j4O+o6zfpXA3tcO6OGclVUEiBrsfzP9U
TLSH B8A2E02B9B9BF26DCF5ECABF6808A8FC7E06E4D054C03D76320345758943A7051D681B
Reporter cocaman
Tags:GuLoader rar


Avatar
cocaman
Malicious email
From: "V.Shanmuga Prakash" <vs.prakash@atlascopco.com>
Received: from mate.com (unknown [173.82.238.222])
Date: Sun, 26 Apr 2020 23:50:23 -0400
Subject: Outstanding Payment
Attachment: Payment Slip_pdf.rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-27 06:35:27 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
22 of 30 (73.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=72wyhhpdkq2ywnitjutbgsx362pfklpferlu447qqfxjng35gq3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar fead839de354358b35134d26134afbf69e552de524574e73f0816e969b7d3437

(this sample)

GuLoader

Executable exe e8967b1c2713c3513dc6acc371f01fed7795d86abc59467304980cb5cce762da

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e8967b1c2713c3513dc6acc371f01fed7795d86abc59467304980cb5cce762da

Comments