MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 967840dc51b335c1d106b347d2320a63d30d3ef2836eceff1be77bc36c7ef371. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 967840dc51b335c1d106b347d2320a63d30d3ef2836eceff1be77bc36c7ef371
SHA3-384 hash: 5584dd01e5ed6b7dc274ca93584b7684e0302082e2886a38f4bcafb2526309051541df47d92215f77ba6c7099909ba51
SHA1 hash: 4a523306db427cc8fd45ce8c03bef8ab249dfbab
MD5 hash: f016429afe99c41e9bd3c925cc01bee7
humanhash: indigo-oxygen-solar-steak
File name:gunzipped
Download: download sample
Signature GuLoader
Create hunting rule
File size:36'864 bytes
First seen:2020-08-18 12:59:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e58144e3e3e012b1bd79180d92c3e0d2 (2 x GuLoader)
ssdeep 384:a05wwB0IdV08P7w6mVJcSqpPCCPf0IuljkatJnqQ3oCPQ5pF1:a8ww2KV1P06OqB2ljkatJnV3TQ3
TLSH E4F2181EF9D7A0B6E55842BD19E6879C0692FF301A5F8A1F35643E1F0C33693A84760E
Reporter abuse_ch
Tags:GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

From: Rachel Liu <sales@gmail.com>
Subject: Electronic invoice generated by DHL Express_Invoice-MAJW-17-08-2020: Air Waybill no 1395482082
Attachment: KMBT 17-08-2020 Air Waybill-Receipt no AWB 140825003078 TBK Need PIB documentations-pdf.gz (contains "gunzipped")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1D5h2KTLDq5FbIvtuKvDZBb8lfQDXvPk2

Intelligence

File Origin
# of uploads :
1
# of downloads :
250
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/47866/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/967840dc51b335c1d106b347d2320a63d30d3ef2836eceff1be77bc36c7ef371/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 13:01:09 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sz4ebxcrwm24duigwnd5emqkmpjq2pxsqnxm57y34554g3d66nyq._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200818-pwmr78hz32/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of SetWindowsHookEx
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/967840dc51b335c1d106b347d2320a63d30d3ef2836eceff1be77bc36c7ef371

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz dbfebe0687ac11c5d8031420100a3210962470e5029cc6816beacfc0b252cc10

GuLoader

Executable exe 967840dc51b335c1d106b347d2320a63d30d3ef2836eceff1be77bc36c7ef371

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/435483/
  
Dropped by
MD5 685b4db04c32a8a7e8ca30bc9b995721
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 dbfebe0687ac11c5d8031420100a3210962470e5029cc6816beacfc0b252cc10
Cape
Cape
https://www.capesandbox.com/analysis/47866/

Comments