MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a28e8b9eb2f43a1ca7bc6d668542d52d8a41644e23546bd3437eab9ed9d15b38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 4
| SHA256 hash: | a28e8b9eb2f43a1ca7bc6d668542d52d8a41644e23546bd3437eab9ed9d15b38 |
|---|---|
| SHA3-384 hash: | 387b81edfbc68e6120621e9d00bd31fda092a57aa9220fe6b63bd68bc47b0bd12185ddecc9345fa9d2dd99780dd3a51f |
| SHA1 hash: | 3ae81d77b80c5348b9d86237660ed95922f375f1 |
| MD5 hash: | e6ed59ea89f99429314d1b865e425c83 |
| humanhash: | happy-dakota-cup-india |
| File name: | Bill of Lading 10-06-2020 SKMBT03783930484040484904003TXT.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 73'728 bytes |
| First seen: | 2020-06-11 06:32:01 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | e266a29e7d76467aa55e8d67ee7908a4 (1 x GuLoader) |
| ssdeep | 1536:bY94d4xRgGq81h4BLpROwzIdJ7rb2ESA465w1D58NRp:K4dNGqbpxWX0AR |
| Threatray | 958 similar samples on MalwareBazaar |
| TLSH | F2735B2EE618E443E03107744C7249545B633D1BAC4FCD1BA9093A7A09B2A53EBEB53F |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader Maersk |
abuse_ch
Malspam distributing GuLoader:HELO: socialmailmarketingworld.fun
Sending IP: 117.50.37.204
From: Maersk Shipping <sales@socialmailmarketingworld.fun>
Subject: Fw: Arrival notice 769480332
Attachment: Bill of Lading 10-06-2020 SKMBT03783930484040484904003TXT.exe
GuLoader payload URL:
https://onedrive.live.com/download?cid=B95C56E530B4B210&resid=B95C56E530B4B210%21109&authkey=AOTKqkXo8sIzokg
Intelligence
File Origin
# of uploads :
1
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Status:
Malicious
First seen:
2020-06-11 04:29:28 UTC
AV detection:
19 of 27 (70.37%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
guloader
Similar samples:
+ 948 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of NtSetInformationThreadHideFromDebugger
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.