MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1671bb2266525b9cd0451b8c2d2f372652af8c7742a1d1285a96536d68a11ddf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1671bb2266525b9cd0451b8c2d2f372652af8c7742a1d1285a96536d68a11ddf
SHA3-384 hash: e3e66b6be6462874ab85ad8967341fad354e6afde285c4134ea0737c644c70af63ae3780fc601ebb4bbefbb4d3238163
SHA1 hash: c551c10075b1dbdddcee4cf5c32b64c18838181d
MD5 hash: e8e0f453d25241c744a6c0ba1cbcbc04
humanhash: august-bakerloo-burger-wolfram
File name:SCAN-QUOTATION-JUNE-SHIPMENT.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:46'537 bytes
First seen:2020-06-02 11:20:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:PmLdpqfaJl5aER4Kx5Y5AUNHbsJpO/oQoutuMzgY2MSZsMDwLmTHfTSjKtvnVHn:wfWaJlNRPeAi7FRIMsYsJY2PVHn
TLSH B5230132DF50BEA3D40B122EA9B701F04D0D81D7852A53F95C990DF2BE8A4D89FF2165
Reporter abuse_ch
Tags:arj GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: samahrazor.com
Sending IP: 182.160.101.162
From: nurul.haque@samahrazor.com
Subject: Request for quotation SAMAH RAZOR ORDER JUNE
Attachment: SCAN-QUOTATION-JUNE-SHIPMENT.arj (contains "kontro-quotation-june-shipment.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1lFbIeySyP7eCKO2WK6a_dXOsuHAH5GKo

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vbkrypt
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 01:57:58 UTC
AV detection:
14 of 31 (45.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=czy3witgkjnzzucfdogc2lzxezjk7ddxikq5ckc2szjw22fbdxpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 1671bb2266525b9cd0451b8c2d2f372652af8c7742a1d1285a96536d68a11ddf

(this sample)

GuLoader

Executable exe 7e45056c46daf65e7826480c454e3237df4d5f5d740828df5b5181cfde5eade0

  
URLhaus
https://urlhaus.abuse.ch/url/374174/
  
Dropping
MD5 50e9e75ebf7fe204cb3892e5fa00e2fd
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7e45056c46daf65e7826480c454e3237df4d5f5d740828df5b5181cfde5eade0

Comments