MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0675a138f08b0532cccf3af953c4f0be023e880a338e2ce3f59b0b2e3bb2246. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a0675a138f08b0532cccf3af953c4f0be023e880a338e2ce3f59b0b2e3bb2246
SHA3-384 hash: ea300c864450f002a797a434e332c12e2c52b4ef37d04b727be25e3f8f3d0064a1172d9bcc4e624cec76aeafc702100c
SHA1 hash: 6ae40da8ba8418ee35ae41de7633874c02e935b0
MD5 hash: 688830d4505a48172c0d6197d5ccce63
humanhash: vegan-fruit-burger-hamper
File name:Presupuesto 20182.LHA
Download: download sample
Signature GuLoader
Create hunting rule
File size:41'003 bytes
First seen:2020-06-09 06:42:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:5YKN3J9POu5aamI+T7Z2/OoZ7bvV6aDzGoSrYO0Smgs7EKUL0/m8Y0TqpKBGIWx:5YKNZ9POu8zvQp6uzaX6TwK3mMAKMp
TLSH 4003E1D5A68D994401BDACE22988EE6C8BBE52257375F3173F2418EDC84B40CDB91CB7
Reporter abuse_ch
Tags:GuLoader lha


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: psm91.troy
Sending IP: 2.56.8.190
From: Rosa Caudevilla <facturacion@tesslibrenta.com>
Subject: Presupuesto 20182
Attachment: Presupuesto 20182.LHA (contains "Presupuesto 20182.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=E63E6173F9A47623&resid=E63E6173F9A47623%21109&authkey=AORoAWItfMA0BOg

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 06:43:11 UTC
AV detection:
17 of 30 (56.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ubtvue4pbcyfglgm6oxzkpcpbpqch2eaum4oftr7lgylfy53ejda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar a0675a138f08b0532cccf3af953c4f0be023e880a338e2ce3f59b0b2e3bb2246

(this sample)

GuLoader

Executable exe 631c795e9e20bfd8d33a2ecc2d8e1e22f925eb2aff8f052904bd779a66ccaada

  
URLhaus
https://urlhaus.abuse.ch/url/384311/
  
Dropping
MD5 43bda6d72deafa56a8c4fa267ee9e673
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 631c795e9e20bfd8d33a2ecc2d8e1e22f925eb2aff8f052904bd779a66ccaada

Comments