MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58a0aeda6764bdb119f336d823c740c2b8950acd7073d42bf79cdae3ce1cd07e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58a0aeda6764bdb119f336d823c740c2b8950acd7073d42bf79cdae3ce1cd07e
SHA3-384 hash: 25c92df2dfb92d6322a5c4be4da565a02e5bbf1ecb69aed41890270478f3d37e55402c03e6f94332f7f50276ff1e7783
SHA1 hash: 9e0703c55d82fc6242e1cb61a10e17d8f1db9377
MD5 hash: 4c0652b8bd7a5e189958dd3373a2c155
humanhash: march-illinois-black-cup
File name:Order _2020982_.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:47'651 bytes
First seen:2020-06-08 12:12:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:0/ZTnzCM+hUpkiohciag1QpOlLlvCNiYuRpskJl6xZDS+CpH1DlA8oXaXGu/5iTr:QTnzCbykio+iapOlLoFiskJlSZO+aVD2
TLSH 8D23F103EF9D9AB4C32C49E62C8547E6F8679F99511E20900C2FD2D7EF6E4F18657A40
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail.huclangia.ga
Sending IP: 64.52.172.242
From: Nadeemi Trading Co. <ubacen@huclangia.ga>
Subject: Fw: Request to Submit PO Acknowledgment for New Purchase Order 2020982
Attachment: Order _2020982_.zip (contains "Duckwifechio1.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1IY0MbGZwCNIl99oNc0IFSARZOGuSi7pe

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CLOUD.5855.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 12:14:04 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lcqk5wthms63cgptg3mchr2ayk4jkcwnobz5ik7xttnohtq42b7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 58a0aeda6764bdb119f336d823c740c2b8950acd7073d42bf79cdae3ce1cd07e

(this sample)

GuLoader

Executable exe d894062069e0d2967a0ca5655892f29e511d37dd5de5f5dc02e7ed54f2e4fe45

  
URLhaus
https://urlhaus.abuse.ch/url/383141/
  
Dropping
MD5 ee2cd4cb49eead0885c24123a5ae439a
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d894062069e0d2967a0ca5655892f29e511d37dd5de5f5dc02e7ed54f2e4fe45

Comments