MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a977332d457ea29fa7b3fdda0c4b0669181018beff8848a5cdb01ffc32f40d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a977332d457ea29fa7b3fdda0c4b0669181018beff8848a5cdb01ffc32f40d6
SHA3-384 hash: f6f63ee4682e1d43976d35841bd712f2ddacfe942236694ab44bf111ddf4a557c725bdf0f18710a33ff6f52ebc51f102
SHA1 hash: 6d880dd73b20c10aa48d5bb0787ddc45502c8684
MD5 hash: d035435c61c04ee08c31dfa822d0a957
humanhash: paris-speaker-march-alaska
File name:payment inv.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:126'976 bytes
First seen:2020-06-09 06:43:24 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:QRuRtS34J5Ui1Zria6WDwCiKVV3uQ6W1e/:N4aHwCiKrZT1e
TLSH 10C37C137D00C253E05046742C979E691B27AC2889829EDF709DBF4FFB727526CAA23D
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: ny.libconsult.ca
Sending IP: 23.227.201.155
From: Shabeer M. T. <habeer@ny.libconsult.ca>
Subject: Payment Assistance Due To Covid-19 Pandemic
Attachment: payment inv.img (contains "payment inv.scr")

GuLoader payload URL:
https://ny.libconsult.ca/bin_dSDTDTjp42.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 06:45:05 UTC
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hklxgmwuk7vct6t3h7o2brfqm2iycaml574ijcs43ma77qzpidla._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 3a977332d457ea29fa7b3fdda0c4b0669181018beff8848a5cdb01ffc32f40d6

(this sample)

GuLoader

Executable exe ea0bcb9c44a356945727a78ca03b727f5ce4dd69accb51dc7fee5918477133be

  
URLhaus
https://urlhaus.abuse.ch/url/384288/
  
Dropping
MD5 70d397bbb7c54497ae0d493c7f127de8
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ea0bcb9c44a356945727a78ca03b727f5ce4dd69accb51dc7fee5918477133be

Comments