MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f2b54211895f5d7c25e849ce1594f1d6cbc2ab209a7b5e81db6252b414d0d38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3f2b54211895f5d7c25e849ce1594f1d6cbc2ab209a7b5e81db6252b414d0d38
SHA3-384 hash: 80b9dc4360bc9476f38f3668ce819cf3fe9b03c3bf16afe41b0e8ff27ae7ec00f714ebd3c337bdc3f207b5925dadb0ee
SHA1 hash: 97644868b2d60d73c70b9d28300d0928dd009026
MD5 hash: 7692d2f6bbe542c01dceb6ffbf2d95a7
humanhash: solar-jupiter-robin-nineteen
File name:IMAGE SAMPLE.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-17 08:25:26 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:DTu4CcqMCYbpaskWlCekiZtzbUpplEMvTFRSJRX1yQbm/lfeOA4jSqlBqC7cq:+VcTCYV7/XE/4X1dcfe1CBqC7c
TLSH 85454B1166985736F32CCB701A7456BB017EFC3075178A0B77DC3A6A6BFAE018B21257
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: omega.angelwalthosting.com
Sending IP: 67.227.227.194
From: Eric <geral@merchandisemania.com.pt>
Subject: RE:ORDER
Attachment: IMAGE SAMPLE.IMG (contains "IMAGE SAMPLE.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=013413CFBBBCFAE4&resid=13413CFBBBCFAE4%211656&authkey=AI9wPCp_k9OKGK4

Intelligence

File Origin
# of uploads :
1
# of downloads :
213
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3f2b54211895f5d7c25e849ce1594f1d6cbc2ab209a7b5e81db6252b414d0d38/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 08:27:06 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h4vviiiysx25pqs6qsoocwkpdvwlykvsbgt3l2a5wysswqknbu4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3f2b54211895f5d7c25e849ce1594f1d6cbc2ab209a7b5e81db6252b414d0d38

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 3f2b54211895f5d7c25e849ce1594f1d6cbc2ab209a7b5e81db6252b414d0d38

(this sample)

GuLoader

Executable exe 11c33fa3d86d42c9464dfda9bb37a5d5e98a8bfec1c0bec8138363830bc201e1

  
URLhaus
https://urlhaus.abuse.ch/url/434380/
  
Dropping
MD5 3d1639d787f49e62a8eaee4d4ae9bb9e
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 11c33fa3d86d42c9464dfda9bb37a5d5e98a8bfec1c0bec8138363830bc201e1

Comments