MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ac628b3ff10b9b840276ff6db874874f2a119d710325aec17b0a30fe80efbc8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ac628b3ff10b9b840276ff6db874874f2a119d710325aec17b0a30fe80efbc8
SHA3-384 hash: 4d29942bf3225b53db07f7d7ebefb8553c7788b90cc7d7b1ff4dea3ed9dbb338494bbe5229540f51d2aa79f0e59fc87c
SHA1 hash: 4713ab89a5a57d49b7d46afec5fb2d9c81b680dc
MD5 hash: 259d323c045939fc979b4a4154e16a0a
humanhash: echo-north-arkansas-thirteen
File name:615452_Invoice_confirmation.iso
Download: download sample
Signature GuLoader
Create hunting rule
File size:131'072 bytes
First seen:2021-01-04 13:20:42 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 1536:TW08f1bxeVHU1rtylPBZIZ5wLNy7Fo2fKKbzmeStk:K3lYUFtyl5sYk7FPfKgzzp
TLSH 5DD3E60261A0E5F6F9C749BE0AD74FB91D1379702C758803F90E228B1B735EE99A4736
Reporter abuse_ch
Tags:GuLoader iso


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail.winpal.net
Sending IP: 210.225.196.133
From: Peter Hamilton <edl@libre-essai.net>
Subject: 'Payment Confirmation'
Attachment: 615452_Invoice_confirmation.iso (contains "615452_Invoice_confirmation.exe")

GuLoader payload URL:
https://victoragboifo.com/ven/janomo_SpclxM91.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
358
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Gen.NN.ZevbaCO.34700.em0@aenRRFab.27453.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ac628b3ff10b9b840276ff6db874874f2a119d710325aec17b0a30fe80efbc8/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2021-01-04 13:21:06 UTC
AV detection:
9 of 29 (31.03%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rldcrm77cc43qqbhn73nxb2iotzkcgoxcazfv3axwcrq72ao7pea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8ac628b3ff10b9b840276ff6db874874f2a119d710325aec17b0a30fe80efbc8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso 8ac628b3ff10b9b840276ff6db874874f2a119d710325aec17b0a30fe80efbc8

(this sample)

GuLoader

Executable exe ab17573224e0a8567845f69380a783a59bef1f4d3574095ce47aea7bdf760e97

  
URLhaus
https://urlhaus.abuse.ch/url/948781/
  
Dropping
MD5 f9622993d9dbc19f8fef45a01ac22c1c
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ab17573224e0a8567845f69380a783a59bef1f4d3574095ce47aea7bdf760e97

Comments