MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87183fcac03b924e3982587e9a91148158deefdd532f176cc73611b9657fa804. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87183fcac03b924e3982587e9a91148158deefdd532f176cc73611b9657fa804
SHA3-384 hash: 91ebb83a59e520dfc6697891f27d3538ae3cd51cf00593f684a8f3bc35cf800e33253d39dfd152eed1b99d4937ecd85e
SHA1 hash: 85631945991b7229654cb26e8d42050b6e74adbc
MD5 hash: 1d400c290dfb5a329ece06927159cf2e
humanhash: fourteen-alaska-princess-violet
File name:document02.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:45'567 bytes
First seen:2020-06-06 19:33:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:X7p22hIhGbfKPlLQQDKbXyulxIsiV5hbqwUSyM/llpWUtM7o/at2M9qdbTK:Xd/kQQmbXyuDc/q3M/pWtqJW
TLSH 7D23F125332C6871DD1AABB697141BD25F8C2350923AC1DE5E6F932E0CC89D4F60E778
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: slot0.evstones.com
Sending IP: 45.95.169.27
From: Nicole Gapes<info@evstones.com>
Reply-To: gapes.nicole@yahoo.com
Subject: Property Purchase & Leasing
Attachment: document02.zip (contains "document02.exe")

GuLoader payload URL:
https://rainbowisp.info/dot/js/piro.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200606-1905.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-06 19:35:09 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q4md7swahoje4omclb7jveiuqfmn5365kmxro3ghgyi3szl7vaca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 87183fcac03b924e3982587e9a91148158deefdd532f176cc73611b9657fa804

(this sample)

GuLoader

Executable exe 0df0a487b38b5d9bdbc8e2c05ba4c639dfe09969f5f68c85da43b46c16a48f6b

  
URLhaus
https://urlhaus.abuse.ch/url/379344/
  
Dropping
MD5 7dfc2a452ed19b7fa281b5108040c8ca
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0df0a487b38b5d9bdbc8e2c05ba4c639dfe09969f5f68c85da43b46c16a48f6b

Comments