MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 554658560f9c8119868615e331a1270daaba9b9976abc053cb53f9ef6a222afe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 554658560f9c8119868615e331a1270daaba9b9976abc053cb53f9ef6a222afe
SHA3-384 hash: ae7164baf32562721456a3d246bc865179d4e25264cd54127bc38511ac2e69ef49c81a4f05d10600269e88f75cb6ac40
SHA1 hash: b41738ff4bdd046db85b54bc7ec9f77804b79a58
MD5 hash: 7a86d2ade56bced749a26b993ed9ab84
humanhash: black-four-helium-batman
File name:SUBSYN.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:24'599 bytes
First seen:2020-06-08 14:48:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:T1AWoFJUkQsU4h2Mnriy8Fx0PBnWagOpsQTMP+se5BAt3DvFeBCnardvZk2N7TYM:hAZapLpYKFxgBPsfPO5O5ydZkwUYJh
TLSH 95B2E1B533B8E48C5D42FE239BD184146D6D5AF9F423E7801C32A92BE5CCB968D850A7
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: yuntong-batt.co
Sending IP: 111.90.141.203
From: Nikolas Leon <nikoleon@yuntong-batt.co>
Subject: RE: RE: 7928/PO/GEN/JUNE 2020
Attachment: SUBSYN.rar (contains "SUBSYN.exe")

GuLoader payload URL:
http://111.90.148.217/eva_MfjtMjXvX90.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 06:07:25 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kvdfqvqptsartbugcxrtdijhbwvlvg4zo2v4au6lkp4662rcfl7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 554658560f9c8119868615e331a1270daaba9b9976abc053cb53f9ef6a222afe

(this sample)

GuLoader

Executable exe 9f2db3c39e19066111590682924d0c124e83b13c1acebca4059722d8e7fc649c

  
URLhaus
https://urlhaus.abuse.ch/url/383076/
  
Dropping
MD5 f827762c548ac55fd7fa39fb803b8b85
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9f2db3c39e19066111590682924d0c124e83b13c1acebca4059722d8e7fc649c

Comments