MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e3d797cb457a742a5f2f09589238b93c8fc6deda81341a468dd0bf90835f691. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e3d797cb457a742a5f2f09589238b93c8fc6deda81341a468dd0bf90835f691
SHA3-384 hash: 8e3594dbbc75caf8836536760562b083b5b3ab15bb6c015f9f43abc1467a5801f148ab55aceaff703e9d7065b24c9555
SHA1 hash: 7b24b71e8fca61e0fdd78b1529d90f3822961c66
MD5 hash: e4e326d4d4b6c96e0d98572b8790e8d8
humanhash: cardinal-magnesium-vegan-butter
File name:New Supplier inquiry 110820THAMZ_PDF.uu
Download: download sample
Signature GuLoader
Create hunting rule
File size:34'821 bytes
First seen:2020-08-12 06:42:24 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:RRM/JwJVkVhVXLfzTmyTaKZ6hOI1SQQeLnxot979lroCF:eoEhVbvmyTLchPxQeLxot9RGw
TLSH 63F2F2F27ECE32C1180FF92B0547730486F7A40DF55ABB1DE609DA22199247B9349E6C
Reporter abuse_ch
Tags:GuLoader uu


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: smtp.aonbd.net
Sending IP: 117.58.240.41
From: Purchase A. S <info@brookvvoodcos.com>
Subject: Re: New Supplier enquiry-PO/Contract Brookswoods
Attachment: New Supplier inquiry 110820THAMZ_PDF.uu (contains "New Supplier inquiry 110820THAMZ_PDF.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=1B9A2752AF248CE2&resid=1B9A2752AF248CE2%21119&authkey=AGzsF4JjGpCq5Ds

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1e3d797cb457a742a5f2f09589238b93c8fc6deda81341a468dd0bf90835f691/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 06:44:05 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dy6xs7fuk6tufjps6ckysi4lspepy3pnvajudjdi3uf7scbv62iq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1e3d797cb457a742a5f2f09589238b93c8fc6deda81341a468dd0bf90835f691

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 1e3d797cb457a742a5f2f09589238b93c8fc6deda81341a468dd0bf90835f691

(this sample)

GuLoader

Executable exe 4e34959fc64a858ee136eadbe68b417e972db2e4f1261f28a80fedc36b9ca94d

  
URLhaus
https://urlhaus.abuse.ch/url/429871/
  
Dropping
MD5 a7ee0a19d3fe5db4e8d605b79429f715
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4e34959fc64a858ee136eadbe68b417e972db2e4f1261f28a80fedc36b9ca94d

Comments