MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d58645ed9e4ced12587d65f7f65974d9c0bb8fa140fa140bf6ce038dee27cc8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8d58645ed9e4ced12587d65f7f65974d9c0bb8fa140fa140bf6ce038dee27cc8
SHA3-384 hash: f4d8b6500868f95911c410a6397d44a6e12598205cf27b2433d9f4758aa3fe5bd01a25dc54ce159c1d3f80613c7aa340
SHA1 hash: 58ac345e7f83a7f26baaa848ccad8fc28caac98e
MD5 hash: e42674c8eb39d285346c4dd045d8308d
humanhash: sodium-venus-dakota-march
File name:PO NEW ORDER-7677686557679780.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:131'072 bytes
First seen:2020-06-10 11:42:06 UTC
Last seen:2020-06-10 11:42:13 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:HO7Oa9ItgsssMqgXULhEh9plBhof1TEVW4qbb/eufekLJjfL64W2y:ggx9LhEtlDo9ToWFGufekLJjfL64W2y
TLSH 78D31A11A6A5BD33D6754AF12EB082545177AC3208E18D03B1AC3F2E1737D4AFE6A35B
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: pbmeurope.eu
Sending IP: 160.20.147.33
From: Petra Hristeva <admin@pbmeurope.eu>
Subject: NEW PURCHASE ORDER 156921
Attachment: PO NEW ORDER-7677686557679780.img (contains "PO NEW ORDER-7677686557679780.com")

GuLoader payload URL:
https://onedrive.live.com/download?cid=E6620D6D780A9D73&resid=E6620D6D780A9D73%21106&authkey=ALx8ExEjpr3v6DI

Intelligence

File Origin
# of uploads :
2
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 11:44:04 UTC
AV detection:
17 of 30 (56.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rvmgixwz4thncjmh2zpx6zmxjwoaxoh2cqh2cqf7ntqdrxxcptea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 8d58645ed9e4ced12587d65f7f65974d9c0bb8fa140fa140bf6ce038dee27cc8

(this sample)

GuLoader

Executable exe f12049965ebca86fd2d5b094273aaaa2bfd299f67856d168252f8b927f2f7bec

  
URLhaus
https://urlhaus.abuse.ch/url/385298/
  
Dropping
MD5 ae587ce4da8a898bbbae3bf1c45111fb
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f12049965ebca86fd2d5b094273aaaa2bfd299f67856d168252f8b927f2f7bec

Comments