MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1812bb7b577d2109185a529f90d82082b630e5e50ff96bcbea762806d60cada. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1812bb7b577d2109185a529f90d82082b630e5e50ff96bcbea762806d60cada
SHA3-384 hash: 1cea5f6cf83e495123cb300d76bc0bb012924b1b46de8145d166c7a802faece20c1657799041a8e4e6ca83233d1f172f
SHA1 hash: f81afc7592b2794e0977aae2fa952a77152e09e2
MD5 hash: 59d752f17403556207af68fb691552c8
humanhash: romeo-undress-nitrogen-undress
File name:SWIFT-89,362 EUR.jpg.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:24'739 bytes
First seen:2020-08-04 15:25:57 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:ZuNa8X6YnfW8JuRqXQOi278EhAMw5zBL7sV/46ASBCDE:kxqYnupEXQOH78EhAMizBfsNLxBCDE
TLSH 5CB2F1DC41ED86F2AB073C3593E2E3E24A377392656F64FC51E911B4427422EAC77982
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mta1.witecompanyglobal.ga
Sending IP: 142.11.194.198
From: Muhammad Sarmad Sultan <sales@witecompanyglobal.ga>
Reply-To: paulas@sigrnfg.com
Subject: RE: Fw: Edgar Hohls
Attachment: SWIFT-89,362 EUR.jpg.zip (contains "SWIFT-89,362 EUR.jpg.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=8E778D4A23C91A07&resid=8E778D4A23C91A07%21117&authkey=AO5mGHew7uCYUr8

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FXX2DBB9F7BEA80.8230.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a1812bb7b577d2109185a529f90d82082b630e5e50ff96bcbea762806d60cada/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 15:27:02 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ugasxn5vo7jbbemfuuu7sdmcbavwgds6kd7znpf6u5ria3lazlna._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/a1812bb7b577d2109185a529f90d82082b630e5e50ff96bcbea762806d60cada

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip a1812bb7b577d2109185a529f90d82082b630e5e50ff96bcbea762806d60cada

(this sample)

GuLoader

Executable exe e8b09f7077354fc4eac453773e0404cfcb88694939d7604165d0ea768249050d

  
URLhaus
https://urlhaus.abuse.ch/url/424356/
  
Dropping
MD5 2dbb9f7bea80db4daaeeccf43e21b59d
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e8b09f7077354fc4eac453773e0404cfcb88694939d7604165d0ea768249050d

Comments