MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 997d62372543bf19d6df7e44fb492822d0d35b40f4a7875430ee36cb6a8a18ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 997d62372543bf19d6df7e44fb492822d0d35b40f4a7875430ee36cb6a8a18ce
SHA3-384 hash: e9fec84a34e05f37a523ba3b2837a038364e7f7fba764d2c6c074dfd4fcdedf20ff5350cf7fd5103fdbb0354dc0a17fc
SHA1 hash: 9037df5bc5828fd8ff42d2c6ea72d26289a1b462
MD5 hash: 3fc1e6984096092d530a4a935b0dabca
humanhash: kilo-minnesota-neptune-beryllium
File name:SCAN123432345432_PDF.GZ
Download: download sample
Signature GuLoader
Create hunting rule
File size:22'366 bytes
First seen:2020-08-19 07:25:19 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 384:3i97JHDKcjLAC9SBDCuJWbyBL9sLfh6/kKYRft9gxSVCv+E0yxwvbjg0FhkT7EG+:yhJmcPAeSBhJ5BL9sV6/kK8t9gxSMZZa
TLSH 30A2D1614149EFB2EACF2BDCC613D6C71318A138F66D4A61CDC68EF6D8C40C1982B6A5
Reporter abuse_ch
Tags:GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: gaia.acosis.net
Sending IP: 194.143.219.142
From: ismail dawar <ismail@dekkosiho.com>
Subject: Re: QUOTATION REF NO:234245435
Attachment: SCAN123432345432_PDF.GZ (contains "SCAN123432345432_PDF.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1ozjtLe327RbhxQ4ylHTa5CyRae0DyfFM

Intelligence

File Origin
# of uploads :
1
# of downloads :
230
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/997d62372543bf19d6df7e44fb492822d0d35b40f4a7875430ee36cb6a8a18ce/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 20:32:18 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tf6wenzfio7rtvw7pzcpwsjielingw2a6styovbq5y3mw2ukddha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/997d62372543bf19d6df7e44fb492822d0d35b40f4a7875430ee36cb6a8a18ce

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz 997d62372543bf19d6df7e44fb492822d0d35b40f4a7875430ee36cb6a8a18ce

(this sample)

GuLoader

Executable exe 726156ccca0ba0077df20db0e438db482c7197d69453b890332ed69a9e509352

  
URLhaus
https://urlhaus.abuse.ch/url/435486/
  
Dropping
MD5 3085617089f02c7b6fceb69bfac9bdab
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 726156ccca0ba0077df20db0e438db482c7197d69453b890332ed69a9e509352

Comments