MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92870d12dde2cffee3661a148bb08be996acca9a5b06fd495e67c7fdb1b158c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92870d12dde2cffee3661a148bb08be996acca9a5b06fd495e67c7fdb1b158c6
SHA3-384 hash: c6b24a330b5676b253533133c253f6432d7d0c6f79a16d7676096d53fe514a0f6b3cb7f77e6749aede3b5c01ab0aaf55
SHA1 hash: 5788f55a90b9e722d7f7fd1c97854989d9cb7d64
MD5 hash: d1b36460f3b784b014c6817fc51eeff1
humanhash: alpha-spring-march-nitrogen
File name:SLD-E2020-0003.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:84'677 bytes
First seen:2020-06-04 10:47:18 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:VVmTZH7ov3WbLlmF1lV0fcbEoykPgnV4MFWN1NjnXG0/OHiscZJPz9Q2:VVMF7m3WolV0GyQgV4MsZX1O7cnPzj
TLSH 448312565DA1717BEEB43642C93A7343E12190E3343691A726FA9DC4F33AC9026EC637
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: sungwon7.co
Sending IP: 111.90.158.36
From: Sebastian <sebastian@sungwon7.co>
Subject: attached selected items and confirmed copy of Quotation for your reference.
Attachment: SLD-E2020-0003.rar (contains "SLD-E2020-0003.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1j9VDy3BRfF84OQEaOGheH7ZZvQMX5ORg

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 11:35:56 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=skdq2ew54lh75y3gdikixmel5glkzsu2lmdp2sk6m7d73mnrldda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 92870d12dde2cffee3661a148bb08be996acca9a5b06fd495e67c7fdb1b158c6

(this sample)

GuLoader

Executable exe 474cad642b1cf88f8d7f922cbfd9b8a00d7fc0eb40cafc0877007ee2884f105f

  
Dropping
MD5 ecc05b3100596aa04de9922ac4deda7a
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 474cad642b1cf88f8d7f922cbfd9b8a00d7fc0eb40cafc0877007ee2884f105f

Comments