MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48ea96ccd885927721ce2ec91472bd49d0dac3c6d36f2e3bcceb5701a9425671. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48ea96ccd885927721ce2ec91472bd49d0dac3c6d36f2e3bcceb5701a9425671
SHA3-384 hash: a25db6bff9168c21400be6f3591d95cfd492a8d717192c35b8a131f29973e6f781342feb1addbad750748531d85780f4
SHA1 hash: 37c9cbd576504596802fb0f5cdbfcc0f90a25ece
MD5 hash: e1d6ab8c06d6b0e522630ac7a47bb456
humanhash: equal-nevada-oranges-rugby
File name:DHL TRACKING DETAILS PDF.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:28'598 bytes
First seen:2020-08-17 18:49:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:KGlV5TWMNC5p3s2lP6kjsP0PV/gzVVzdO8FPfv:KoV5TbK3tTjsP0VKV7Pn
TLSH F3D2F1BC4059D16ED41A7AA3D121BA2C4C8DF5C3FCF378E0293E626C5363D86DD62906
Reporter abuse_ch
Tags:DHL GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: slot0.bototyra.com
Sending IP: 104.168.194.225
From: DHL EXPRESS INTERNATIONAL<info@bototyra.com>
Reply-To: infodhl_internation@fastservice.com
Subject: DHL SHIPPMENT ARRIVAL NOTICE
Attachment: DHL TRACKING DETAILS PDF.gz (contains "DHL.PDF.bat")

GuLoader payload URL:
https://onedrive.live.com/download?cid=A4000DE54B92DCC6&resid=A4000DE54B92DCC6%211064&authkey=APebNdB6tStXywI

Intelligence

File Origin
# of uploads :
1
# of downloads :
211
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/48ea96ccd885927721ce2ec91472bd49d0dac3c6d36f2e3bcceb5701a9425671/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 18:51:06 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jdvjntgyqwjhoioof3eri4v5jhinvq6g2nxs4o6m5nlqdkkckzyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/48ea96ccd885927721ce2ec91472bd49d0dac3c6d36f2e3bcceb5701a9425671

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 48ea96ccd885927721ce2ec91472bd49d0dac3c6d36f2e3bcceb5701a9425671

(this sample)

GuLoader

Executable exe 53b08ccf3f21eb6c4c2556fd290210d57d8bcdfc92735573ee20839b81a2a98d

  
URLhaus
https://urlhaus.abuse.ch/url/434475/
  
Dropping
MD5 38a11b45b9b878ef81cc13faaabf26a9
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 53b08ccf3f21eb6c4c2556fd290210d57d8bcdfc92735573ee20839b81a2a98d

Comments