MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ab1a4e102f4ff67ca59657b180d4ecf665dba6cd23993239bd831243189b26d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ab1a4e102f4ff67ca59657b180d4ecf665dba6cd23993239bd831243189b26d
SHA3-384 hash: c6f13a580c0b2637dde330a20365d1ecfa19cbb8a16b17642bbc20558dda5cab08465d965e76b6451adfdfc823ca3eb2
SHA1 hash: e01d76f55598b6a82e1af2c2204b94f9a3a66564
MD5 hash: 00119724c3d234c7ff129e69cf22d771
humanhash: magnesium-bluebird-queen-delaware
File name:777504307241.GenesisAWB.PDF.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:45'036 bytes
First seen:2020-06-08 09:20:38 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 768:JEd2eAR8dCDLJ6O2d/yVL0ZbZbPyUtXWQup+EH3k9ssAiSbzA/jOh977VYiCpipI:Jcdoj2NKUbZbPPoJ2ssAiSbYjkBBOpi6
TLSH E313F1F1FD9FE0D516057D017BF8BAFF02EA57F82B3181F95A449D761A9E48A02020B5
Reporter abuse_ch
Tags:FedEx GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: host.sidhiciang.net
Sending IP: 67.222.24.138
From: Fedex Station Admin Office <tax@suryaindo.com>
Subject: [EXTERNAL] : FedEx PRE Notification of Arrival - AWB# 770116605315 // Jakarta: Need BC23 Confirmation
Attachment: 777504307241.GenesisAWB.PDF.gz (contains "777504307241.GenesisAWB.PDF.exe")

GuLoader payload URL:
https://cmdtech.com.vn/MY_XXX_VUVHawg214.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Razy.681950.14938.31646.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 09:22:10 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dky2jyic6t7wpsszmv5rqdkoz5tf3otm2i4zgi433aysimmjwjwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 1ab1a4e102f4ff67ca59657b180d4ecf665dba6cd23993239bd831243189b26d

(this sample)

GuLoader

Executable exe a7b55b6bfafb6d370f94ff25e294f90d28818a1842ecad4546d18334c616cb97

  
URLhaus
https://urlhaus.abuse.ch/url/371510/
  
Dropping
MD5 0c33fcb253489257ccdf79acd1ac5d44
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a7b55b6bfafb6d370f94ff25e294f90d28818a1842ecad4546d18334c616cb97

Comments