MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a69361df12b114cfaba615dbd846f54551deafa5d13e7f3bc76304b22ec6356d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a69361df12b114cfaba615dbd846f54551deafa5d13e7f3bc76304b22ec6356d
SHA3-384 hash: 7b9ae39e426976c1b0b10e350c19c31c415eee6f3736ab5f8d082ba6ecd2adb313102a872833316af51d639885338ce5
SHA1 hash: cbf56b940b01b7b3693fa441a8b17abc270874ff
MD5 hash: 4194df0c054517eeb3041d0dc3c49fe6
humanhash: whiskey-victor-cup-ohio
File name:applicationpdf 8810422.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:24'486 bytes
First seen:2020-08-05 08:04:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:Yp2m+i6G+uH2CBdBkfmrlgQ0q4OsvNfMfbwT5TjF6dXc96tukmf1kGYUha:YT+DGX2CvBiQr5FfbwT5TjIOGm9Zdha
TLSH 7FB2E088893771E1C78BF0889EEE1F8ADF3ED879D29AB8D620524102A5354148C3D6BD
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: gmail.com
Sending IP: 156.96.44.186
From: PROCUREMENT <akhai.cyber@gmail.com>
Reply-To: widodo.seltechutama@gmail.com
Subject: RFQ: ORDER #097224
Attachment: applicationpdf 8810422.zip (contains "applicationpdf 8810422.exe")

GuLoader payload URL:
http://anakleather.ir/ebukaaa_ByMaIrHe60.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.43597330.21151.22022.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a69361df12b114cfaba615dbd846f54551deafa5d13e7f3bc76304b22ec6356d/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 08:06:07 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u2jwdxyswekm7k5gcxn5qrxvivi55l5f2e7h6o6hmmclelwggvwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/a69361df12b114cfaba615dbd846f54551deafa5d13e7f3bc76304b22ec6356d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip a69361df12b114cfaba615dbd846f54551deafa5d13e7f3bc76304b22ec6356d

(this sample)

GuLoader

Executable exe 8d88c99ff33ecbed42e4185b925f890a616aa0307a559d61595ab67dae6a1a09

  
URLhaus
https://urlhaus.abuse.ch/url/424597/
  
Dropping
MD5 28b3056eba6eeb7c37a93a1847e0e5fe
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8d88c99ff33ecbed42e4185b925f890a616aa0307a559d61595ab67dae6a1a09

Comments