MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 585ece54f7fe126c060b256bd219a4ccd4cfa0ed841b8f0e152445d8601194a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 585ece54f7fe126c060b256bd219a4ccd4cfa0ed841b8f0e152445d8601194a0
SHA3-384 hash: 3677beccc1b84b3dab51e24585e855c2873931ccd01dbe652715e99c76ee81cb9b10340a2dc8678bfe08fd695d8dc746
SHA1 hash: f557e21d6c6a59939c8d8b95ff2906b07403990c
MD5 hash: 584d3147448b1b95fa1a1272b3573635
humanhash: venus-timing-fix-utah
File name:Items Materials Required for the Federal Precinct in Zayed City.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:30'130 bytes
First seen:2020-06-10 06:50:13 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:Zgzo3MNIzZUs/BGHZF57murw3xCJCRkgNz/6M9rp:ZYo3MNyh5G53m0ACTgh/Jd
TLSH E9D2F1A60B4B59591C4348BC4F630D4930CD4475FD2298BA2F37D8C49BBB3A447B9BD1
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mailmarketingworldpad.live
Sending IP: 106.75.36.102
From: Sachini Rathnayeka <sales@mailmarketingworldpad.live>
Reply-To: Sachini Rathnayeka <office.rep@mail.ru>
Subject: RFQ: Infrastructure, Public Realm & Residential Buildings for Federal Precinct in Zayed City
Attachment: Items Materials Required for the Federal Precinct in Zayed City.rar (contains "Items & Materials Required for the Federal Precinct in Zayed City.com")

GuLoader payload URL:
https://onedrive.live.com/download?cid=B3805920E5EB0711&resid=B3805920E5EB0711%21123&authkey=AJ18p0rtfbTWA84

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 06:52:07 UTC
AV detection:
17 of 27 (62.96%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lbpm4vhx7yjgybqlevv5egneztkm7ihnqqny6dqverc5qyarssqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 585ece54f7fe126c060b256bd219a4ccd4cfa0ed841b8f0e152445d8601194a0

(this sample)

GuLoader

Executable exe 541c870536f63dd8b9eb7406fec6031505c59f5c21c8a6f581e5b29349a4a92b

  
URLhaus
https://urlhaus.abuse.ch/url/385265/
  
Dropping
MD5 0595e02c4aaef75b1db97c17f3fbbef7
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 541c870536f63dd8b9eb7406fec6031505c59f5c21c8a6f581e5b29349a4a92b

Comments