MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a65a1c33c71f2a374ade0d5f420ab1264353234a75f28e48ab94562a4a1d56b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a65a1c33c71f2a374ade0d5f420ab1264353234a75f28e48ab94562a4a1d56b
SHA3-384 hash: 6a9933bc838f1b7b856cf39baab60d445f4845948bbc6b6564fb16ab02f8813b41cc99409c8b5539db28bc56d89451a8
SHA1 hash: 52d3c5d031866ca3e11ed4705d90eeee418f2a2e
MD5 hash: 2a196eb58292f345c5500eb33ce68546
humanhash: kilo-maine-india-pip
File name:Proforma_Invioce 00190.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:31'443 bytes
First seen:2020-05-27 12:48:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:oqnCKZzV5tgqvQ7WGh+DbHJe6X1BDFQjZMOEX/WQsd1yEgvfx:G8zV5hvmMNt13QCPLI1zy
TLSH 32E2F165288A299C9D13DC1FEFC19220A9EDB7FE2B575318C476D29710744B8FE3218E
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: nj-homeimprovement-contractor.com
Sending IP: 45.137.22.117
From: Anwar Marcus <pdi@nj-homeimprovement-contractor.com>
Reply-To: Anwar Marcus <pdi@nj-homeimprovement-contractor.com>
Subject: Re: Confirm revised invoice to proceed with payment ASAP.
Attachment: Proforma_Invioce 00190.zip (contains "Proforma_Invioce #00190.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1dz8-iw3L5E1Shc2UNoT8S6v5bweh5N3j

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.FareitVB-AE.16842.27704.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 13:58:03 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 6a65a1c33c71f2a374ade0d5f420ab1264353234a75f28e48ab94562a4a1d56b

(this sample)

GuLoader

Executable exe 20be0c183bcbe3cf8b803b2afa2a87fddd7ec2adc68666fa29eb15c77292a0b9

  
URLhaus
https://urlhaus.abuse.ch/url/369891/
  
Dropping
MD5 0ec8358b6ad33555441df80aaf54024f
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 20be0c183bcbe3cf8b803b2afa2a87fddd7ec2adc68666fa29eb15c77292a0b9

Comments