MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35663c6c218458c23a7b4578019f173961895e1241dc9d4e14253b5516b31d96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35663c6c218458c23a7b4578019f173961895e1241dc9d4e14253b5516b31d96
SHA3-384 hash: 9e4db145e8ef1c26ae5b1c9ff8f951f6a547b8c51d89f80ad8bbbb2d4c3b966e0ed2e3133c8cc0fbc13c89374e88ffc7
SHA1 hash: 8184db05ad3c88b5274b21215593bd4d40118e80
MD5 hash: 1a0ca102a6389c0555d879186f660ae0
humanhash: eighteen-social-vegan-kilo
File name:2020 06 02.cab
Download: download sample
Signature GuLoader
Create hunting rule
File size:41'049 bytes
First seen:2020-06-02 11:21:47 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 768:FU2crb6oVjkmBWhRBWN4xMvo2HUjGC11O1+SCf313CDUjUi:yrbL/BWPBWO2vIid1qYYIi
TLSH B80302FDACC8664DC5D0AEF60C6BDC623E3A7390D24A7F040A3D8494143C25D6E1D2B1
Reporter abuse_ch
Tags:cab geo GuLoader KOR


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm45.hanmail.net
Sending IP: 203.133.180.233
From: 비 엘 두 주 식 회 사 <gisuk3391@hanmail.net>
Subject: 견적용입니다 긴급으로 견적만 주세요
Attachment: 2020 06 02.cab (contains "WT20200602.exe")

GuLoader payload URL:
http://ekenefb34logs.webredirect.org/uploud/5bab0b1d864615bab0b1d864b3/wj1_tIaUf126.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Nanocore-7995242-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vbkrypt
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 08:43:27 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gvtdy3bbqrmmeot3iv4adhyxhfqysxqsihoj2tqueu5vkfvtdwla._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

cab 35663c6c218458c23a7b4578019f173961895e1241dc9d4e14253b5516b31d96

(this sample)

GuLoader

Executable exe 9a1bbd02f1dc5ae62f13a00f38067354bf8a754e72e3ebee49a8b6aaa7b7e41f

  
URLhaus
https://urlhaus.abuse.ch/url/374156/
  
Dropping
MD5 1921af0786119e3dfb5492185f9f5670
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9a1bbd02f1dc5ae62f13a00f38067354bf8a754e72e3ebee49a8b6aaa7b7e41f

Comments