MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ee50b3ae0cdf30990165bdbbe0193de842a56b4ad32d353884f68246bf7c72f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ee50b3ae0cdf30990165bdbbe0193de842a56b4ad32d353884f68246bf7c72f
SHA3-384 hash: 97b0623d0525777892e72b676723f673d350c66117b057922fda87e1b340079d7a4af85c8bb23c6ead60686ea2af42b9
SHA1 hash: 89213504505d10cbc70c25766a5bfe72d063fe96
MD5 hash: 9761848f2ccf5899a4d4686e174f1f6a
humanhash: louisiana-white-georgia-zulu
File name:Z1100ST5N.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:24'539 bytes
First seen:2020-06-08 09:20:03 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:dXXPFK9Au6Fhs6brYHlNsujRUQmRpjP9hQg4YZzzSTND1UcT/TbAd1SiUSX:dHPYSs6Xw3jRUrRpjP6AzSXUI/TUdGS
TLSH 41B2F157971272A33E9BFF386799F3059C60820FC0FC8BB21C4C9A645D1AC624AF1A70
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: yuntong-batt.co
Sending IP: 111.90.141.203
From: Tongfei Wang <wang@yuntong-batt.co>
Subject: RE: INQUIRY FOR DTR
Attachment: Z1100ST5N.rar (contains "Z1100ST5N.exe")

GuLoader payload URL:
http://111.90.148.217/mazo_WzdQAtYOZ233.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 09:21:06 UTC
AV detection:
18 of 30 (60.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p3sqwoxazxzqteawlpn34amt32ccuvvuvuzngu4ij5uci27xy4xq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 7ee50b3ae0cdf30990165bdbbe0193de842a56b4ad32d353884f68246bf7c72f

(this sample)

GuLoader

Executable exe 37a3468d527e22a4cdd0c1e8717a5bca60db2cd8aaace1a4d25b65eeccd8079c

  
URLhaus
https://urlhaus.abuse.ch/url/383077/
  
Dropping
MD5 fa9c3546895fdbe453ebead002291750
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 37a3468d527e22a4cdd0c1e8717a5bca60db2cd8aaace1a4d25b65eeccd8079c

Comments