MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 510fcb054b0a6141df87d6c3b7512ca669596a1ecbf47df11605b331f1f17324. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 510fcb054b0a6141df87d6c3b7512ca669596a1ecbf47df11605b331f1f17324
SHA3-384 hash: 1628c71d954ef12fc95467d971c13224607456394c4edeab98211072d1117c42aee0a39a0ce594522ad5687f81b61f6c
SHA1 hash: a1a1ce38e603d36742ddb4fa50f61d50202a7cab
MD5 hash: 0dfd24e53af8021c269c6c5331ffe120
humanhash: washington-carolina-winter-single
File name:file.xls.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-27 17:15:16 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:ewB/kOpPWSGRi246ib19jkuH33QzipmvHIsW:nB/9Ps73odHnQjvov
TLSH D845D51B7390AC72DC384F71187195786D32BE293A015B07B58DB72E3F725DA28E0B1A
Reporter abuse_ch
Tags:geo GuLoader img KOR


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm44.hanmail.net
Sending IP: 203.133.180.232
From: 무소의 뿔처럼 <mj2919@hanmail.net>
Subject: 첨부도면 견적요청 드립니다.(한석이엔지 입니다.)
Attachment: file.xls.img (contains "WJ3PO20200527.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1cBAwAGwis_WSHsWgU-xx-UBisxwt2yB5

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.879400.18450.20361.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 18:37:20 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 510fcb054b0a6141df87d6c3b7512ca669596a1ecbf47df11605b331f1f17324

(this sample)

GuLoader

Executable exe c9ab5be38ab7174e733c55d730b50c0e046dafbca139255af8791800a80cd32e

  
URLhaus
https://urlhaus.abuse.ch/url/369930/
  
Dropping
MD5 847ebd813c7d0688342c79fc8395f8f5
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c9ab5be38ab7174e733c55d730b50c0e046dafbca139255af8791800a80cd32e

Comments