MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ac46ab6a553db53dbad4b98b9425f5956ba4d5e3153c9035333a2f1f34c7725. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ac46ab6a553db53dbad4b98b9425f5956ba4d5e3153c9035333a2f1f34c7725
SHA3-384 hash: 0c89dbddc92eb9a635815d476afca468a0cdea0c9fd216e190258cfa52d44957092bceccced3420f6e2127f4fe1c345b
SHA1 hash: 0478f59066d91c6b8608b1cb4eec07d15da38b8c
MD5 hash: 410bd58cb850179c943a0b49136b729e
humanhash: yankee-hamper-grey-thirteen
File name:New supplier Inquiry and PO 081820505_ DOC.uu
Download: download sample
Signature GuLoader
Create hunting rule
File size:22'506 bytes
First seen:2020-08-18 19:38:03 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:jHh9KnVbrAPbvpxtDsfhGpKviJCvfJV1lT+I3N1Pkk/uCLnMs+B5jslur:j7EboTVpKXvfJVuCsk/uCjMd7js0r
TLSH C6A2E08A8C5E55EB9C004172131AA4493CBB2689FAB0E6DCFE4685DE37797C75C6C0CC
Reporter abuse_ch
Tags:GuLoader uu


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: smtp.aonbd.net
Sending IP: 117.58.240.41
From: Purchase Vertex Safety A.S <suzetrey@netvision.net.il>
Subject: Re: New Supplier Inquiry Vertex Safety and Medical Equipments.
Attachment: New supplier Inquiry and PO 081820505_ DOC.uu (contains "New supplier Inquiry and PO 081820505_ DOC.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=1B9A2752AF248CE2&resid=1B9A2752AF248CE2%21123&authkey=AAQTcXmKPvFMf1E

Intelligence

File Origin
# of uploads :
1
# of downloads :
249
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9ac46ab6a553db53dbad4b98b9425f5956ba4d5e3153c9035333a2f1f34c7725/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 17:52:27 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tlcgvnvfkpnvhw5njomlsqs7lfllutk6gfj4sa2tgorpd42mo4sq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9ac46ab6a553db53dbad4b98b9425f5956ba4d5e3153c9035333a2f1f34c7725

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 9ac46ab6a553db53dbad4b98b9425f5956ba4d5e3153c9035333a2f1f34c7725

(this sample)

GuLoader

Executable exe 50d68559290556e9e3524e8aec940a98b4564b57cc2a60f79d4da9a7d1f8de46

  
URLhaus
https://urlhaus.abuse.ch/url/435485/
  
Dropping
MD5 808a8887d16e40fe025e48d7e24b4374
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 50d68559290556e9e3524e8aec940a98b4564b57cc2a60f79d4da9a7d1f8de46

Comments