MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8cc7d032661b2c76ac519838568e7d5642c95a400244ec4c297fb9b7c051884b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8cc7d032661b2c76ac519838568e7d5642c95a400244ec4c297fb9b7c051884b
SHA3-384 hash: 30ed9799730d771eb16a731c90c658378bdc8049a4db11d64b73b5318464a3db87771aa16832cbc974c12b0620345c97
SHA1 hash: f854e7698fa1866f9d231d46511e6220bb731e88
MD5 hash: ce8b1b7267876480a54eca2aedf2abb2
humanhash: missouri-pennsylvania-lemon-artist
File name:Purchase Order SK-20071405 From BOSUNG.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-19 13:35:42 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:l9FsGjyAXl109kJwfzwk4hfvxCvISXeMC6PBTI:BHj109gP1CQSXeMLBc
TLSH 704580296E7C3F6FE3F91230095246B456A5A8F0DA16CFC2F60C366E0B75E01985F792
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: sh37.ich-7.com
Sending IP: 184.154.80.146
From: bosung <masiur@infancyit.com>
Subject: Purchase Order SK-20071405 From BOSUNG Eng.
Attachment: Purchase Order SK-20071405 From BOSUNG.IMG (contains "RFQ.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=138UKyynMrtGy6YdSISWRI9JqEDfvZvCA

Intelligence

File Origin
# of uploads :
1
# of downloads :
232
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8cc7d032661b2c76ac519838568e7d5642c95a400244ec4c297fb9b7c051884b/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 11:31:48 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rtd5amtgdmwhnlcrta4fndt5kzbmswsaajcoytbjp643pqcrrbfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8cc7d032661b2c76ac519838568e7d5642c95a400244ec4c297fb9b7c051884b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 8cc7d032661b2c76ac519838568e7d5642c95a400244ec4c297fb9b7c051884b

(this sample)

GuLoader

Executable exe 3b8f8c5da5f2aa72adb56a42195330329e279ffbc1958fd568008fc8e5916b70

  
URLhaus
https://urlhaus.abuse.ch/url/436361/
  
Dropping
MD5 90893d36822ef4363a2b2221d2754d7d
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3b8f8c5da5f2aa72adb56a42195330329e279ffbc1958fd568008fc8e5916b70

Comments