MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51487c019cfae8a5221a2607242105521b33563c8f35cc61211926bb5600f8b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51487c019cfae8a5221a2607242105521b33563c8f35cc61211926bb5600f8b1
SHA3-384 hash: b8e8bdd001c671686e2a5e2a23efbd45bbc39f8557352ee89bf5a76581062f57248ebb57389a75b68542143de0cb68d3
SHA1 hash: e4538e7a50a0079ba813f21e664e7eb17335e2e6
MD5 hash: 2b830c9623b8a41ca30b1b66259e8a4a
humanhash: freddie-football-golf-robert
File name:DOOYOUN CORPORATION Emergency Production Request-pdf.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-08 12:05:18 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:F5ysFY6TjMHvGpVrlSZpbUl0goKKKY8osyD:exuQHv+VlSZpwln5YpD
TLSH BE45AE036C05C692F05183B05D939B8623666D296A025ED73ADD2FAFEF34AC32DE531D
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server.ecomotorhk.com
Sending IP: 162.144.56.225
From: Jaeho Lee <ydchoi1@naver.com>
Subject: DOOYOUN CORPORATION Emergency Production Request
Attachment: DOOYOUN CORPORATION Emergency Production Request-pdf.img (contains "order.exe")

GuLoader payload URL:
http://149.255.36.133/bin_PqLAqQjAza233.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Razy.681950.28602.22245.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 12:07:07 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kfehyam47lukkiq2eydsiiifkintgvr4r424yyjbdetlwvqa7cyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 51487c019cfae8a5221a2607242105521b33563c8f35cc61211926bb5600f8b1

(this sample)

GuLoader

Executable exe 6fb77f025210f6eafed61a9216a3d9df986d352a5594f62547990fc0880e6e43

  
URLhaus
https://urlhaus.abuse.ch/url/378987/
  
Dropping
MD5 17322dfa70443b446fafe45e1988991e
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6fb77f025210f6eafed61a9216a3d9df986d352a5594f62547990fc0880e6e43

Comments