MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff015e299500e8d9d07ae57e6e0e33ec9ee9a0dba566008d57dd241b990908d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff015e299500e8d9d07ae57e6e0e33ec9ee9a0dba566008d57dd241b990908d3
SHA3-384 hash: 0835f52d3da46c36ca8cbe71960459f60cdaf4970fbcebd958d6fac09555e12cec4d43da6054a99e4a0123d2bf3642d1
SHA1 hash: d201846f267b518b914cea8e74062db14a5d72f1
MD5 hash: 5b46c768825999601dd0462f15d6ce36
humanhash: crazy-missouri-fanta-zebra
File name:Invoice.r15
Download: download sample
Signature GuLoader
Create hunting rule
File size:30'547 bytes
First seen:2020-06-10 06:51:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:I6sRpaAFbgbUvK0H9Cjpre1Ebz3NcJpYd8U8EOJmB8:CGSbgIS0Hz2qJTEOI8
TLSH 96D2E1C12E292C1659CDC173B8C70BB4366B49B2CA46DF29C9F6FE22931171465C6AB2
Reporter abuse_ch
Tags:GuLoader r15


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: host130.cityonlinebd.net
Sending IP: 113.212.108.130
From: Fadi Tahboub <fadi.tahboub@mst-dealer.com>
Reply-To: sales04person@yandex.com
Subject: Re: Shipment
Attachment: Invoice.r15 (contains "Invoice.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1dkHPX9jRoX1-NYrdSgqyjYEkTF58oqFX

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27502.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 06:53:06 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=74av4kmvaduntud24v7g4drt5spotig3uvtabdkx3usbxgijbdjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar ff015e299500e8d9d07ae57e6e0e33ec9ee9a0dba566008d57dd241b990908d3

(this sample)

GuLoader

Executable exe 8c4e8ce35d87b95b71843c0998da344746ce0194aa9a3aefad595eb59708d75f

  
URLhaus
https://urlhaus.abuse.ch/url/385249/
  
Dropping
MD5 4ddc64df2203fe9b65cab5050f7d27c9
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8c4e8ce35d87b95b71843c0998da344746ce0194aa9a3aefad595eb59708d75f

Comments