MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 781409bfaa56ba983b5a3a2b4d3a061b73449a7a1b7c45ac98b693f06949dccc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 781409bfaa56ba983b5a3a2b4d3a061b73449a7a1b7c45ac98b693f06949dccc
SHA3-384 hash: 9012b6f4edcf4ab4fe7bc0bd8e2b302df9389efe5d82a8286f7e332a9ec257bc1109077ea9c56a0c340b29edd2ccb3d8
SHA1 hash: ffe8a03a068821b6006908d3c6cd57e944b89dea
MD5 hash: 576a363ae03377527fe921fdd61b0793
humanhash: alpha-bravo-happy-louisiana
File name:Shipping Details_PDF.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:17'936 bytes
First seen:2020-11-03 07:35:46 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:ZO9AjpOaty/lgWhlpeO77xPOxmb2pctzfN3fu:ZwANO4y9gWXpL7FPOIb2pcFxu
TLSH A882D122246BAB76FD8B0D4334BDB2710E1E45AEF35C7920D0685415F63235844B7DB3
Reporter cocaman
Tags:GuLoader rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""DHL Express" <support@dhl.com>"
Received: "from vnv0.730.sfjido.ml (vnv0.730.sfjido.ml [143.110.157.236]) "
Date: "Mon, 02 Nov 2020 23:28:47 -0800"
Subject: "DHL AWB:1668788356"
Attachment: "Shipping Details_PDF.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/781409bfaa56ba983b5a3a2b4d3a061b73449a7a1b7c45ac98b693f06949dccc/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-11-03 07:37:05 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pakatp5kk25jqo22hivu2oqgdnzujgt2dn6elleyw2j7a2kj3tga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/781409bfaa56ba983b5a3a2b4d3a061b73449a7a1b7c45ac98b693f06949dccc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 781409bfaa56ba983b5a3a2b4d3a061b73449a7a1b7c45ac98b693f06949dccc

(this sample)

GuLoader

Executable exe b2d7fa1333a5961bda5ebab33039aee56eb4b38ecf03b3d9e72564426c321568

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b2d7fa1333a5961bda5ebab33039aee56eb4b38ecf03b3d9e72564426c321568

Comments