MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 901006673b6b9803a6bd126224b8abf22e9253860dddcde4b117dddd2caf2e32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 901006673b6b9803a6bd126224b8abf22e9253860dddcde4b117dddd2caf2e32
SHA3-384 hash: bf3be9887ecc7e603ff38e5262b486cc9fc5e000d0c11cba22f309de09a62bf82dfd3f7fe4098b67b139d70a2d50ab27
SHA1 hash: e95ed94d5bcc7efb7ea6106db31b759ca61e87a9
MD5 hash: dae934b0a4116387191ae4faab1d2411
humanhash: colorado-pennsylvania-mockingbird-echo
File name:REVISION OF INITIAL QUOTATION.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:30'995 bytes
First seen:2020-05-26 07:25:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:QrqW5vXBIgBn+r1ve/vFa/Ce68eza/4BK+sgn0mvizzd68Fh3:Q+W5vXBvJcvekvNeZM8VKzd68j3
TLSH F6D2F152BB548280C16E31F4510D3E25FEA51A1236D27A3F24A1ECF087E377A97BE493
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: megatech.com
Sending IP: 156.96.62.50
From: Purchase Manager<info@megatech.com >
Reply-To: Sophiaxu01@gmail.com
Subject: REVISION OF INITIAL QUOTATION
Attachment: REVISION OF INITIAL QUOTATION.zip (contains "REVISION OF INITIAL QUOTATION.exe")

GuLoader payload URL:
http://hosseinsoltani.ir/wp-includes/IXR/legacy_bJhKCdoEqV203.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33903782.30782.24875.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 07:36:23 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 901006673b6b9803a6bd126224b8abf22e9253860dddcde4b117dddd2caf2e32

(this sample)

GuLoader

Executable exe 0e11032c40b88ae18b88c56392c3e7468971f9c0d19a422c1d626bed2133219e

  
URLhaus
https://urlhaus.abuse.ch/url/368658/
  
Dropping
MD5 9a6551741830303765b3d94df6c5404b
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0e11032c40b88ae18b88c56392c3e7468971f9c0d19a422c1d626bed2133219e

Comments