MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24cafe8f07681d612145f45bb7d5a1ddf4bb6bc4ca9b348a17b189dc4771b404. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24cafe8f07681d612145f45bb7d5a1ddf4bb6bc4ca9b348a17b189dc4771b404
SHA3-384 hash: c9b0e4b4ca3f58d986fc3f04df0db18f59153430eb3ffcaff1e3469555c3a33fb678b5b1d868c277677e1836eb5e67ec
SHA1 hash: f93074f65b36584c89cd0851bf644ca37c03db39
MD5 hash: a533af92c696278406e0ddfc0309af07
humanhash: mirror-stream-avocado-lake
File name:items needed.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:24'866 bytes
First seen:2020-08-05 07:21:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:sBvKSYUcXaCmqWMmTuzyqmHv8KwkuD9a4iGv5lei:GOhaCXmTuWPHv8c4hHv
TLSH 5EB2D097F171B71C7A405B7363CA6C358C34BAD11FC78928448B254607376EE6BB9960
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: RELIE.NET
Sending IP: 156.96.62.51
From: SBD@RELIE.NET
Subject: Sales Quotation 194659 - ZELLERBACH
Attachment: items needed.zip (contains "cartelism.exe")

GuLoader payload URL:
http://anakleather.ir/chima_fSQnhm101.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FXXE84C44D6535D.10047.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/24cafe8f07681d612145f45bb7d5a1ddf4bb6bc4ca9b348a17b189dc4771b404/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 07:23:08 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=etfp5dyhnaowcikf6rn3pvnb3x2lw26ezkntjcqxwge5yr3rwqca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/24cafe8f07681d612145f45bb7d5a1ddf4bb6bc4ca9b348a17b189dc4771b404

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 24cafe8f07681d612145f45bb7d5a1ddf4bb6bc4ca9b348a17b189dc4771b404

(this sample)

GuLoader

Executable exe d9073504ba97540b65006d851251f330bcfb130500daad9a7f8616cb5a6a9ba0

  
URLhaus
https://urlhaus.abuse.ch/url/424596/
  
Dropping
MD5 e84c44d6535da8c4ffbae8fcf08de286
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d9073504ba97540b65006d851251f330bcfb130500daad9a7f8616cb5a6a9ba0

Comments