MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 159aeeef6a95ef162e4330753ac0b582d7b97c6183b082f3dd393923f2331256. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 159aeeef6a95ef162e4330753ac0b582d7b97c6183b082f3dd393923f2331256
SHA3-384 hash: ef1037fbbcbfec192db2532d16c8fc4c2d771df1c2de64f027123c955ce8ad38325c1baac0f5d63536010328827a56f1
SHA1 hash: b9306539cb3d766c75142d8e7ba3688cac8c916b
MD5 hash: 00ba8e2307b14df5699df924baef3548
humanhash: mexico-uncle-delaware-lithium
File name:Nuevo orden.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-13 16:54:04 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:Nkr+25jDOxOa5iUpTpg/O2gIt2toUmHipmDUGetCsU38cI11XmBWQOEsh:E/5wOvw8gItqroip7IePOBWLj
TLSH 15452807B3E1DD62DA004BB21E91D6D4152ABC3458224903BDEE363D7B3A657DBE132B
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.viteltek.com
Sending IP: 104.237.144.27
From: "alejandro.alvarez" <colosio_her@camposreyeros.com>
Subject: RE: Nueva orden de consulta
Attachment: Nuevo orden.img (contains "Nueva orden.PDF.bat")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FileRepMalware.18712.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 03:54:45 UTC
File Type:
Binary (Archive)
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cwno533ksxxrmlsdgb2tvqfvqll3s7dbqoyif465he4sh4rtcjla._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 159aeeef6a95ef162e4330753ac0b582d7b97c6183b082f3dd393923f2331256

(this sample)

GuLoader

Executable exe 8299fb84b56afeccbd7542f9c33d66fc40f5ab48fe5076479dd66c24f5d19fa0

  
Dropping
MD5 727a47853e64b4224a0b0ba09c22cb32
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8299fb84b56afeccbd7542f9c33d66fc40f5ab48fe5076479dd66c24f5d19fa0

Comments