MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7de6b095abcd50f8f674b3772462c509fee2144e930a3ccb14d2f5117954a216. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7de6b095abcd50f8f674b3772462c509fee2144e930a3ccb14d2f5117954a216
SHA3-384 hash: 516a1333e3b3358a22288778e2213aa5fbccefd24fd4a48f069d37505ac3b6d97d3badf6f3a76a4a589e78b36ead2c8d
SHA1 hash: 7a0d66fdcd9996dbcaaa22dff2bd7ac337a1b136
MD5 hash: 084faea18d7ec3024b7f15b2cb7e79f4
humanhash: kentucky-social-cola-robin
File name:TNT Original Invoice_pdf.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:73'012 bytes
First seen:2020-06-03 06:10:09 UTC
Last seen:2020-06-03 06:11:34 UTC
File type: gz
MIME type:application/gzip
ssdeep 1536:ok5cLeUK/jQEB0CbzE67FIJVUY/4Xr7xtrIB9ojnbYaDm8pt69hf54:ok5g/KbQME67FIJVN47PIBI8Wm8C94
TLSH 236301C9F84E25EC2D061DDDB219FB3064AAF4485EF791DBDEAC95A1283510E0E58A3C
Reporter cocaman
Tags:GuLoader gz


Avatar
cocaman
Malicious email
From: TNT Shipment Notification<463.celumltd.casa@342.drointernational.casa>
Received: from mail0.463.celumltd.casa (mail0.463.celumltd.casa [178.62.198.19])
Date: Tue, 02 Jun 2020 14:27:16 -0700
Subject: TNT Consignment Notification for 243740512
Attachment: TNT Original Invoice_pdf.gz

Intelligence

File Origin
# of uploads :
2
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 06:35:33 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pxtlbfnlzvipr5tuwn3siywfbh7oefcosmfdzsyu2l2rc6kuuila._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 7de6b095abcd50f8f674b3772462c509fee2144e930a3ccb14d2f5117954a216

(this sample)

GuLoader

Executable exe eec46d65be09a86f25c891d462671a7a0b3140ee4a8a6ac0a9fa7e1c56a8cb40

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eec46d65be09a86f25c891d462671a7a0b3140ee4a8a6ac0a9fa7e1c56a8cb40
  
Dropping
MD5 967bda63be01726d9e336921c49d4304

Comments