MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5aa809de0391e256d77dbfe802f9bf61bd2e9ea588e24ab1119ce931e74e2038. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5aa809de0391e256d77dbfe802f9bf61bd2e9ea588e24ab1119ce931e74e2038
SHA3-384 hash: bc30b617169f791cb6e39f126bfac90e60c920b1c8b89d4edfeefaeb88f1f64e8f855188246ad957f478c96818af4ad1
SHA1 hash: be0a1a334eaea63cca0bf82f12156e06080b9bc4
MD5 hash: 5c0d0203fa05fc4753c38e10c3403437
humanhash: alaska-table-echo-two
File name:OFFER.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:131'072 bytes
First seen:2020-06-10 12:36:11 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:qJ7OSlpf6kAtZPlw11mgazYivb+Pj82lZ1krXjIWAq6jIfMr:clpPAtZUmgNW+PnwjjAPjI0r
TLSH 0FD34A16B6E1AD72D63556F62EB0D25450A7BC3304F18803755C3B2F6B3B946FAA230B
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: etudteknik.com
Sending IP: 45.11.19.137
From: Ella Collins <Info@etudteknik.com>
Subject: RE: Request for Quotation - New Client Contact
Attachment: OFFER.img (contains "gerberia.com")

GuLoader payload URL:
http

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Gen.NN.ZevbaF.34128.em0@aSsetelG.7534.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 12:38:05 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lkuatxqdshrfnv35x7uaf6n7mg6s5hvfrdrevmirttutdz2oea4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 5aa809de0391e256d77dbfe802f9bf61bd2e9ea588e24ab1119ce931e74e2038

(this sample)

GuLoader

Executable exe cffb28f48a39b040f06f0563eaaac0a99f06accf37cc5da95383805c17c583c3

  
Dropping
MD5 2b4fd76e5fdc57076d7f2be51614eff0
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cffb28f48a39b040f06f0563eaaac0a99f06accf37cc5da95383805c17c583c3

Comments