MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c72c160eaaff55dd63473b8f5d775cf11cdb67a795f4544931a37efe90c7256. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c72c160eaaff55dd63473b8f5d775cf11cdb67a795f4544931a37efe90c7256
SHA3-384 hash: 259f46b074b2d9d70485c5cdd88acc744f0bb6365948fb8fb79bc003f53a45faed261bc52b4929c99fe4b41efc4c46f0
SHA1 hash: b7101e93475e1d4196467b68d40555dee33aa600
MD5 hash: ab1bd0f84a18c1e0f52a36df19e9d100
humanhash: carpet-pluto-earth-mockingbird
File name:Swift03172021.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2021-03-18 06:18:32 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:giC5RKIYUSozFKwvFIREc2ZGs61ETRwm4F55hRYwHDL1V2CEgYXCGZIF8t1vR9Uh:mR8ZozFKwvFqEc2PIc3qIOeW
TLSH 0545A3DFE6A54703E511BE312354D32D3F20BC253052CF537E5C6A3A2B79682A4BE686
Reporter cocaman
Tags:GuLoader img SWIFT


Avatar
cocaman
Malicious email (T1566.001)
From: ""Department for International Pymts" <swift.halifax@protonmail.com>" (likely spoofed)
Received: "from mail.ivet.bg (mail.ivet.bg [79.98.106.118]) "
Date: "Thu, 18 Mar 2021 00:21:35 +0100"
Subject: "SWIFT DOZNAKA 1/MS EUR 72197,18 20210317"
Attachment: "Swift03172021.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
287
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.32516.32122.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c72c160eaaff55dd63473b8f5d775cf11cdb67a795f4544931a37efe90c7256/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2021-03-18 06:19:08 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
13 of 47 (27.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=drzmcyhkv72v3vruoo4plv3vz4i43nt2pfpukretdi3672imojla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/1c72c160eaaff55dd63473b8f5d775cf11cdb67a795f4544931a37efe90c7256

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 1c72c160eaaff55dd63473b8f5d775cf11cdb67a795f4544931a37efe90c7256

(this sample)

GuLoader

Executable exe 04e561913818e236846b11ce9dc11e40ca04e86e55c1ec314d1aedd2435b221b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 04e561913818e236846b11ce9dc11e40ca04e86e55c1ec314d1aedd2435b221b

Comments