MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9951fc457c824c735c430beb457f5bc5e23c1dfa0107d17624c787e4b04f070f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9951fc457c824c735c430beb457f5bc5e23c1dfa0107d17624c787e4b04f070f
SHA3-384 hash: 1b0a0dc3e7ed8bb6de376df540ce709643f62ae9ee6b0e9ad20adb9701590982afb9fefdc9a0a775befa3a775a26b4a6
SHA1 hash: 936d57a31838d120f078def37b97ec2aef03b9d2
MD5 hash: dd7a65fba8dc30c47fccfb387b2dd8e3
humanhash: pizza-hawaii-neptune-lemon
File name:FedExShipmentBillOfLading21102020.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:114'688 bytes
First seen:2020-10-22 06:36:06 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 384:Wp1pi0hYBiEfF3liasCBrwitLtLtNZjqT0vVjihLU59Jk/0S:Wp1pi0clACBrwKxxvqQdi5UvJ6
TLSH 97B317DFB744C02DFDA14E740A3ABA8756736F251C136A0E354C3B2D6F3254898A2F46
Reporter abuse_ch
Tags:FedEx GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: pap.pulapint.nl
Sending IP: 167.99.187.212
From: FedEx Express shippment <FedEx@fedexshipping.com>
Reply-To: FedExshipping@fedex.de, FedExshipping@fedex.com
Subject: FedEx BILL OF LADING SHIPPING DOCUMENTS
Attachment: FedExShipmentBillOfLading21102020.img (contains "semisacred.exe")

GuLoader payload URL:
https://nyclofttours.com/2_UVIwMVloNr82.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9951fc457c824c735c430beb457f5bc5e23c1dfa0107d17624c787e4b04f070f/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 23:49:04 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tfi7yrl4qjghgxcdbpvuk723yxrdyhp2aed5c5rey6d6jmcpa4hq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img 9951fc457c824c735c430beb457f5bc5e23c1dfa0107d17624c787e4b04f070f

(this sample)

GuLoader

Executable exe e3bb363542c6d38bc7cf43863d0247e9e9c96c5176f4c0cf4bbd3bbe2afbd31e

  
URLhaus
https://urlhaus.abuse.ch/url/733037/
  
Dropping
MD5 870d091c46b19cece0c7000c9491a6b8
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e3bb363542c6d38bc7cf43863d0247e9e9c96c5176f4c0cf4bbd3bbe2afbd31e

Comments