MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85c55bf4f31e32da19c7f7fbecd535ca0275323e5cb7b4896ada14dabbcc53b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85c55bf4f31e32da19c7f7fbecd535ca0275323e5cb7b4896ada14dabbcc53b6
SHA3-384 hash: 771ddd04807efd91c40b9626e249acf405b518cfc8dbba5f6d604f2fccf51d8629e490a8dc1fa249ab60267eae670e5e
SHA1 hash: bca015c03b0f166d7d963645aa1ade29e1d3911c
MD5 hash: 35dd47d4e6408b8f2407e7563e772e45
humanhash: vegan-berlin-pasta-vermont
File name:BL DRAFT AND SHIPPING DOCUMENTS.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:143'360 bytes
First seen:2020-06-06 08:41:28 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:qDrdLtwa8mHVpIJwDwvTnJqGZG3UyT+vFht2Xb:crdhOmVpPEkENIXb
TLSH F8E36C136D48E825D1895EB06C62999727163C082A015F7F35CCFFAEEB316E2789770B
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: wsuche.com
Sending IP: 81.169.140.45
From: Doc <document@jabsinternational.com>
Reply-To: rnnfibi@outlook.com
Subject: PRE SHIPMENT ADVICE
Attachment: BL DRAFT AND SHIPPING DOCUMENTS.img (contains "BL AND SHIPPING DOCUMENTS.exe")

GuLoader payload URL:
http://180.214.239.54/nbin_aKNXfFIB29.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.893124.25587.8462.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-06 08:43:05 UTC
AV detection:
13 of 30 (43.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qxcvx5htdyznugoh6756zvjvzibhkmr6ls33jclk3iknvo6mko3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 85c55bf4f31e32da19c7f7fbecd535ca0275323e5cb7b4896ada14dabbcc53b6

(this sample)

GuLoader

Executable exe ad57fdea21b1f9e56e500568a6dba42e239fbed6bbc3e825ccf0342e6f1a9064

  
URLhaus
https://urlhaus.abuse.ch/url/382438/
  
Dropping
MD5 1d1bbdcbe710a2f42e18456aea0fbe70
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ad57fdea21b1f9e56e500568a6dba42e239fbed6bbc3e825ccf0342e6f1a9064

Comments