MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2436eabe4d6730ffd6767a0d9c41cab8a50e2ef764332aa0de2b5487e98e8828. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2436eabe4d6730ffd6767a0d9c41cab8a50e2ef764332aa0de2b5487e98e8828
SHA3-384 hash: 10e1a9a05f5c61bf94494cf7e4ca3b30f158b9d565e6488a069ca4aae7e6c3be01fae629e6941fa7fc4a87008a5b1e2c
SHA1 hash: bffe52b8030b36a55a758910ed4dc1a28f6e395b
MD5 hash: e8b1bca2179005dd236cc97cb2036f52
humanhash: oklahoma-leopard-pip-triple
File name:64900658_0rder_Receipt.iso
Download: download sample
Signature GuLoader
Create hunting rule
File size:106'496 bytes
First seen:2020-10-20 06:28:41 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 768:Q0+lSPct4xthnxNQpPofZnSI+CduO0UXdjPjzDDDDDDDDDD8:elSPQSxYWnSZCdvdXDDDDDDDDDD8
TLSH 5EA34A5F66705BB9CE5686BE0A31263C21DFB820C2B19A0FF13F191D0B37650D9E8B65
Reporter abuse_ch
Tags:GuLoader iso


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: torfep04.bell.net
Sending IP: 184.150.200.209
From: Laurence Simard <itil@lipetsk-pivo.ru>
Subject: Your order has been delivered!
Attachment: 64900658_0rder_Receipt.iso (contains "64900658_0rder_Receipt.exe")

GuLoader payload URL:
https://trackit.gr/ven/octnew_WEvCwpWnO118.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2436eabe4d6730ffd6767a0d9c41cab8a50e2ef764332aa0de2b5487e98e8828/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 20:50:30 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eq3ovpsnm4yp7vtwpigzyqokxcsq4lxxmqzsvig6fnkip2moraua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2436eabe4d6730ffd6767a0d9c41cab8a50e2ef764332aa0de2b5487e98e8828

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso 2436eabe4d6730ffd6767a0d9c41cab8a50e2ef764332aa0de2b5487e98e8828

(this sample)

GuLoader

Executable exe f0cd0d44e8eb5d76e7ebb79fd5633814ecd3aeb8251dff223b0be04c1963616d

  
URLhaus
https://urlhaus.abuse.ch/url/721901/
  
Dropping
MD5 7fc0364a71327a662bf435f49e9613e4
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f0cd0d44e8eb5d76e7ebb79fd5633814ecd3aeb8251dff223b0be04c1963616d

Comments