MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 020c8f1bb1b8f0fa50ca6181ed60f58b1ced7d8d7eeeee7c9c6d8b84f7946b99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 020c8f1bb1b8f0fa50ca6181ed60f58b1ced7d8d7eeeee7c9c6d8b84f7946b99
SHA3-384 hash: 37bdab549ccacbde622d5ae1bb1496762c0ec2960e9da6c631c1b712586bd8c283b40f992866c8e4eeebbbef87d4de35
SHA1 hash: cab15f8b7cca2e5a9ff0f7fa7c0b6b7f78e92bc1
MD5 hash: 2b995a71fe19c3503b8668932772999c
humanhash: network-michigan-alaska-kansas
File name:Order 742094 for August.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:24'568 bytes
First seen:2020-08-05 17:20:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:qDQszI1UWUvLAkqvpdcLkStfOO48PZpCZxFrvYMyOA2fXB12O+lgWA:q7+UWvkUpdcv5OGTCZxFrFfX/2vl6
TLSH FFB2E096F9686F8BEE0491789353818B343E60988E0FC5A90BE2937542B7657037F768
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: vetterstone.com
Sending IP: 156.96.44.186
From: Vetterstone Gen Enterprise<terry@vetterstone.com>
Subject: Procurement Listing Order 742094
Attachment: Order 742094 for August.zip (contains "Order 742094 for August.exe")

GuLoader payload URL:
http://zarnaftdiar.ir/henryyy_KKELE245.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23990.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/020c8f1bb1b8f0fa50ca6181ed60f58b1ced7d8d7eeeee7c9c6d8b84f7946b99/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 17:22:05 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aigi6g5rxdypuugkmga62yhvrmoo27mnp3xo47e4nwfyj54unomq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/020c8f1bb1b8f0fa50ca6181ed60f58b1ced7d8d7eeeee7c9c6d8b84f7946b99

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 020c8f1bb1b8f0fa50ca6181ed60f58b1ced7d8d7eeeee7c9c6d8b84f7946b99

(this sample)

GuLoader

Executable exe c688c6b0f5bd44c8d37e810000892ce8d0e2225f1dd04a92d454fd60c7cdc779

  
URLhaus
https://urlhaus.abuse.ch/url/424797/
  
Dropping
MD5 241d24f99836600e018078c031ca8b59
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c688c6b0f5bd44c8d37e810000892ce8d0e2225f1dd04a92d454fd60c7cdc779

Comments