MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac39aa5b44b7f678b47ab25056d1ba009547d3fbb69ae1d949649756ae28e8fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac39aa5b44b7f678b47ab25056d1ba009547d3fbb69ae1d949649756ae28e8fc
SHA3-384 hash: 79c6ffe4a94ae6070bfe40fa61a0232d95ebeccd1221a69cbf12bd65ad7e10c7f3df796a58b5214c0475d3e6c241980f
SHA1 hash: ca4644d53e605cbe98aee0f98f28c931e0be7a1d
MD5 hash: 3aaf77118fb4d062e1cb52b7c156d774
humanhash: bluebird-bakerloo-video-low
File name:Scan_53T83559.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-26 07:22:52 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:G8ddGTZ18Q+HAewihTjNpky+hEapPnf5jp:G8dd6Zj0g3pvfX
TLSH DD4509127AD5DCF9DEB51BB10C329AA86C36FC2118020B53368DB74D1B3B6CC6DA075A
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: biza0.feedtrades.com
Sending IP: 103.124.107.37
From: Infin Bank <creditnotice@infinbank.com>
Subject: Payment Advice: SWIFT OUTWARD: MT103 640S74485683
Attachment: Scan_53T83559.img (contains "Scan_53T83559.exe")

GuLoader payload URL:
http://185.205.209.166/wext/net-x_SVsddcSkXN90.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Injector.EMCU.1433.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 07:36:28 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img ac39aa5b44b7f678b47ab25056d1ba009547d3fbb69ae1d949649756ae28e8fc

(this sample)

GuLoader

Executable exe 2b1ce8b7b958de2d36f9a47285647550b4dc5abe03b1fcca176237f3bb794faf

  
URLhaus
https://urlhaus.abuse.ch/url/368664/
  
Dropping
MD5 daa41fe9512c11dee8eb2d1374180c2a
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2b1ce8b7b958de2d36f9a47285647550b4dc5abe03b1fcca176237f3bb794faf

Comments