MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 685dc737184ee2a1dbf42267b80cb6439e113e7a09e9827f537c143bc689903f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 685dc737184ee2a1dbf42267b80cb6439e113e7a09e9827f537c143bc689903f
SHA3-384 hash: ffae8726d813ca48c6fd1fc454041a7c01cd2612959a41741f7da6a0ec4def77989536f2a5bd62772791830057cd50d7
SHA1 hash: 2d41f42c55c3e9cac302a8092c1dd115b74d4ebd
MD5 hash: 58820dfe5ae549668d460e4f988ed617
humanhash: spaghetti-comet-summer-timing
File name:file
Download: download sample
Signature GuLoader
Create hunting rule
File size:32'361 bytes
First seen:2021-01-20 20:45:03 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:doph+EU6yy/Cnzlop7pl9TqYGwORMT1zz6jUmUpgYGhGtYgKW:doph3fT2ajkRMT1f6jUnihGtYgz
TLSH 9DE2F15F7AA5604B441540D00497F9B394B760172A293CBD8F38BFCF9E45FD06A26BE4
Reporter fabjer
Tags:arj

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/685dc737184ee2a1dbf42267b80cb6439e113e7a09e9827f537c143bc689903f/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2021-01-20 20:37:28 UTC
AV detection:
11 of 47 (23.40%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nbo4onyyj3rkdw7uejt3qdfwiopbcpt2bhuye72tpqkdxrujsa7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/685dc737184ee2a1dbf42267b80cb6439e113e7a09e9827f537c143bc689903f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 685dc737184ee2a1dbf42267b80cb6439e113e7a09e9827f537c143bc689903f

(this sample)

GuLoader

Executable exe 31665a69dca33ae199f7f8149e0ca8d992c6e402e01bfc4e7eeaab46a40d33f0

  
Dropping
SHA256 31665a69dca33ae199f7f8149e0ca8d992c6e402e01bfc4e7eeaab46a40d33f0
  
Delivery method
Distributed via e-mail attachment

Comments