MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81f54e904ad8bbee5801be7607b98112dcf14241d0b96d1b85c85596c129c350. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81f54e904ad8bbee5801be7607b98112dcf14241d0b96d1b85c85596c129c350
SHA3-384 hash: 640c79f53127c94f7de0feca61c9be1917b350fe5bb45eda736acfd04ed4a1b9fe5960d1f6e73f270de1a0e75b8c1fcc
SHA1 hash: bb880291896e7b11bd754c4a73cfd1ba2af91f6f
MD5 hash: fc1b753b89ccbf9c5c2bc160cbd4ab8c
humanhash: july-romeo-delaware-william
File name:Remittance_90523_03.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:49'100 bytes
First seen:2020-05-28 13:14:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:4RvXKeCPyFHW2pdFZ4WnDJjcFOj2L2RRqOcaBt9TXnF8f+Wh9BzCvAyJh5WF:ubCPy9WYdv4WDJYFy2LsqOXtnGfth9hr
TLSH AA2301D01793607096669FDCD4E7C08639FAAADBF7C50BAB99B08A33C381651084F770
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mola.com
Sending IP: 173.82.106.44
From: Accounts <hang.tuong@deltamarin.net>
Subject: REMITTANCE ADVICE: IF01200022823419
Attachment: Remittance_90523_03.rar (contains "Remittance_90523_03.exe")

GuLoader payload URL:
https://qif.ac.ke/flow_AoGPhiVz245.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 13:38:07 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 81f54e904ad8bbee5801be7607b98112dcf14241d0b96d1b85c85596c129c350

(this sample)

GuLoader

Executable exe 0afe73609922b94ffb25f673db3b621befab30c7f52cd586497b63f8154dbd6d

  
URLhaus
https://urlhaus.abuse.ch/url/365459/
  
Dropping
MD5 2dba676e2a87d3383ebc404845b604fb
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0afe73609922b94ffb25f673db3b621befab30c7f52cd586497b63f8154dbd6d

Comments