MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22073e5afdba0cb0bd4e19686fd55f0f73f28cb997631bebc7b6cc717284eae6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22073e5afdba0cb0bd4e19686fd55f0f73f28cb997631bebc7b6cc717284eae6
SHA3-384 hash: e1488c050bf7901a462aa6ccdbc8ab47a76a0d33b992971b7cd974f030e3e726052e6f2a7ee8f9834bbdb25bf4a0d637
SHA1 hash: b8ac3aa32a9bd9720486c9257d284b6b5113c5b1
MD5 hash: 542b54f55c4eec62a5e488b6d60743fc
humanhash: robert-item-pizza-early
File name:COMANDA DE ACHIZITIE IANUARIE 2021 BUCURESTI.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:30'700 bytes
First seen:2021-01-18 18:32:26 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 768:U8EcsPtV3e+qXs/1+l/xbU0BIZXNdRshr/CCYr9Rw:U8MO+qc/kvIXGOfr9Rw
TLSH 49D2F1476FF3E90EBA9DC65B50F92279DFB0A1CCE59C1953C1AE824CAF3401AEC51258
Reporter abuse_ch
Tags:geo GuLoader gz ROU


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: server.devbox12.com
Sending IP: 162.249.2.44
From: Dan Andreea <andreea.dan@tecnet.ro>
Subject: COMANDĂ DE ACHIZIȚIE IANUARIE 2021 BUCUREȘTI
Attachment: COMANDA DE ACHIZITIE IANUARIE 2021 BUCURESTI.gz (contains "COMANDA DE ACHIZITIE IANUARIE 2021 BUCURESTI.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1EJpPIgyAnRofJyYxs2NL68l1f2OIahwX

Intelligence

File Origin
# of uploads :
1
# of downloads :
261
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/22073e5afdba0cb0bd4e19686fd55f0f73f28cb997631bebc7b6cc717284eae6/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 11:14:36 UTC
AV detection:
10 of 29 (34.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eidt4wx5xiglbpkodfug7vk7b5z7fdfzs5rrx26hw3ghc4ue5lta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/22073e5afdba0cb0bd4e19686fd55f0f73f28cb997631bebc7b6cc717284eae6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 22073e5afdba0cb0bd4e19686fd55f0f73f28cb997631bebc7b6cc717284eae6

(this sample)

GuLoader

Executable exe 024efdea9bd03882907a3f706a12ba4e889ec2955228fe42ac47257f9212ade8

  
URLhaus
https://urlhaus.abuse.ch/url/970674/
  
Dropping
MD5 75a330fa7015ca929cd4ab373b84eb5b
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 024efdea9bd03882907a3f706a12ba4e889ec2955228fe42ac47257f9212ade8

Comments