MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbfac399deae5afe90429bf4edd5cb0fdf855c8eebebfc2e91c6b84d2683f1ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fbfac399deae5afe90429bf4edd5cb0fdf855c8eebebfc2e91c6b84d2683f1ae
SHA3-384 hash: d6e6eb3c89c0d5dff83f6423f5c375907aa069366eb1f8b89c24307122c48ecbeecf028bf228264a92aa20b1ef6f007a
SHA1 hash: f6a3d6d47bb2243f3f4c31e86053b0178f2ee16d
MD5 hash: 8f712c1ddfbcd997ef1e29dde2bcc706
humanhash: mobile-failed-harry-hamper
File name:file.cab
Download: download sample
Signature GuLoader
Create hunting rule
File size:42'795 bytes
First seen:2020-06-02 11:25:49 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:EsR+yv8TpdoLQGXdj265JZuP3Lxacf9sGCYY+jHz1gNRx+sqkzB49QnHzyBq9b7:hv8950FuPb8ysGYkJ8Rx+s1hHWB8f
TLSH 5713F29FB06D4D56AF473F94B3E59EC640848F569873848D5BDA01AA530CBEC201B1E7
Reporter abuse_ch
Tags:cab GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm49.hanmail.net
Sending IP: REDACTED_DOMAIN]t [203.133.180.237
From: UTITECH <parkbokjin@hanmail.net>
Subject: 유티아이테크-발주서 송부의건
Attachment: file.cab (contains "file.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=809F316B561D99CA&resid=809F316B561D99CA%21156&authkey=AAcCJtFdwbo1Azc

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vbkrypt
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 07:54:01 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7p5mhgo6vznp5ecctp2o3volb7pykxeo5pv7ylury24e2jud6gxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar fbfac399deae5afe90429bf4edd5cb0fdf855c8eebebfc2e91c6b84d2683f1ae

(this sample)

GuLoader

Executable exe 6fe57f40ae9b9edc3998f059efc437b71702b66bfe3e3f61f13c8a89dadfbb56

  
URLhaus
https://urlhaus.abuse.ch/url/366513/
  
Dropping
MD5 70353f2ed6a4a94eb61398836bb9141c
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6fe57f40ae9b9edc3998f059efc437b71702b66bfe3e3f61f13c8a89dadfbb56

Comments