MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6bf41c77ddbe1b1559d490660e27e936e1ffc79b0735af95ccde8dd0e6d38cdd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6bf41c77ddbe1b1559d490660e27e936e1ffc79b0735af95ccde8dd0e6d38cdd
SHA3-384 hash: fad7b8824cb93c90d6bc7ac98a9fdb7f7220833b94c8117cc0fc27f492261a38138229fe9f35d4826b1f80a6fb26a4bc
SHA1 hash: d1184c0ec2be32c2d7eefb2382f855256a9edabf
MD5 hash: 42c860e92b93c98cdc4b885ec926f3bd
humanhash: network-mississippi-florida-comet
File name:order catalog.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:24'649 bytes
First seen:2020-06-08 09:20:27 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:rYdCR5RENpXqSwb7SYIOvctLG/cXoGMBuWChqqG5L7XVqQsCZK7wVzdtiU:FEN4YfQctLGkYGMrChqqG5POSpVzdtiU
TLSH BDB2E0C2587071729326AE3B77AD0BA0FF5942D82E77C70167C043681A98B7573E4F69
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: thaimartin.co
Sending IP: 111.90.145.52
From: Mahov Aleksandr Ivanovich <torcd@yandex.ru>
Reply-To: hashik@arabain-industries.net
Subject: Order catalog
Attachment: order catalog.rar (contains "order catalog.exe")

GuLoader payload URL:
http://111.90.148.217/AKU_BrLfCUCwsr238.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 09:22:08 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=np2by565xynrkwousbta4j7jg3q77r43a4227fom32g5bzwtrtoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 6bf41c77ddbe1b1559d490660e27e936e1ffc79b0735af95ccde8dd0e6d38cdd

(this sample)

GuLoader

Executable exe 99c1199a2f1bf8476f318ead8972af0dd77c13686039fb1a3f73b4f02789fd76

  
URLhaus
https://urlhaus.abuse.ch/url/383078/
  
Dropping
MD5 2951274dc7260c2fff076ef35e077cfa
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 99c1199a2f1bf8476f318ead8972af0dd77c13686039fb1a3f73b4f02789fd76

Comments