MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8cf57ea9965aed9959a8f3c710268f65dd3bcdbefd7e069b7ee72abe48c26d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8cf57ea9965aed9959a8f3c710268f65dd3bcdbefd7e069b7ee72abe48c26d5
SHA3-384 hash: 47314c83e99d4a1aaf0ee3f6dcd94d202738fc8af8f00a1c02723a5c011ae3f9720a1782fad84dfd118537765325d084
SHA1 hash: 443e9cf710ca3d6b84b42c75497c15996c9d3b75
MD5 hash: 4d8b510574cb3b95f82f73fa488e6ab8
humanhash: fruit-fruit-hamper-bulldog
File name:RFQ-100620.iso
Download: download sample
Signature GuLoader
Create hunting rule
File size:135'168 bytes
First seen:2020-06-10 17:28:51 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 1536:iITIP394d4xRDZ7FxJ7rbPFZT5AZ+bIMH:G4dcDbXdF
TLSH 57D34A2EE618D193D4210B304471159262637D1B243FA91BB95D2A2B0BB3D63BAD773F
Reporter abuse_ch
Tags:GuLoader iso


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: distribucionesduch.acens.net
Sending IP: 176.28.110.186
From: Christain Alexandra. <chritain@silletas.com>
Subject: RFQ-Pressure Control Equipment.
Attachment: RFQ-100620.iso (contains "Fazendas9.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1ksIeIHMjbgQ6VVtqaMWD0ERZUQBLjPV-

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CLASSIC.13617.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 17:30:12 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vdhvp2uzmwxntfm2r46hcati6zo5hpg357l6a2nx5zzkxzeme3kq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso a8cf57ea9965aed9959a8f3c710268f65dd3bcdbefd7e069b7ee72abe48c26d5

(this sample)

GuLoader

Executable exe 49f0ff9807e26ef36ac569e35fa391522472272a9af4dbfca04b0057e4d71d99

  
URLhaus
https://urlhaus.abuse.ch/url/385860/
  
Dropping
MD5 ca39caedca09bd719aee2af18b5f71d5
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 49f0ff9807e26ef36ac569e35fa391522472272a9af4dbfca04b0057e4d71d99

Comments