MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b6b56f381297f08bad9c27f08893ad0b2b87df28a395a6fa7090cf6593042c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b6b56f381297f08bad9c27f08893ad0b2b87df28a395a6fa7090cf6593042c3
SHA3-384 hash: d14fd8a74c69a7cec75078788ae312025d04454a1338d8b6c15c67f9663e6fec87e9c2763e94b371ef36728a828f700d
SHA1 hash: bd0d5f50ef057868ff04e7b1b0e5ec8556a5ab3c
MD5 hash: 6f8271ea461ac3855f619f335a60b2cb
humanhash: colorado-quebec-alaska-romeo
File name:ORDER_9012.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:74'481 bytes
First seen:2020-06-04 06:02:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:Qn4/Keni4DBUMquxqV4ycVQiAUFI6GEhM:eyi49nqzmAUFI6HhM
TLSH 7B7302981DDADCE79DA7B1294E244204B858E8FC479B50BDCA2F8EFB105C88745FB174
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: yuntong-batt.co
Sending IP: 111.90.141.203
From: MUBARAK AL GHAMDI <m.ghamdi@yuntong-batt.co>
Subject: RE:RE: URGENT ORDER
Attachment: ORDER_9012.rar (contains "ORDER_9012.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=198sTkcPquSAvb3efOapquu4MpsdDGAlG

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 10:09:08 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hnvvn44bff7qrowzyj7qrcj22czlq7psri4vu35hbegpmwjqilbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 3b6b56f381297f08bad9c27f08893ad0b2b87df28a395a6fa7090cf6593042c3

(this sample)

GuLoader

Executable exe 916237116e09e4233846389b7410a8ccc7e7ef96c0ed97c3fdb19a08499504af

  
URLhaus
https://urlhaus.abuse.ch/url/378982/
  
Dropping
MD5 bb8ee9b1843f4f481a6fdc2c2144a750
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 916237116e09e4233846389b7410a8ccc7e7ef96c0ed97c3fdb19a08499504af

Comments