MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b042ae50dabec97b633270a7197b5a9ba58f7ff4d67fad2e95855d9004bfc196. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b042ae50dabec97b633270a7197b5a9ba58f7ff4d67fad2e95855d9004bfc196
SHA3-384 hash: cbce933bc29917af95a8bf7b756af538143787800adca37c8e81f8d999d2b9924a84876191ffbd1af4be450d5f2fbf87
SHA1 hash: 73b1eaee90034e8d5a26168b40accb6ade0a621e
MD5 hash: e90e8c64dd78b940fee335d12cfbc705
humanhash: ten-charlie-minnesota-delaware
File name:quote.iso
Download: download sample
Signature GuLoader
Create hunting rule
File size:131'072 bytes
First seen:2020-06-10 11:40:09 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 1536:1iF7O2g+TepEQSdX5kXeLQPLgXKdkMM5TkYwpa6rCl3Xjcl0k:kedSSFLgX8M5oZrCl3Xjcd
TLSH E8D33A1179A1ADB2DB754BF63DB0926450A7B83109EAC903741C3B5E2B3B84BF67134B
Reporter abuse_ch
Tags:GuLoader iso


Avatar
abuse_ch
Malspam distributing GuLoader:

From: Sarah <sarah.james@mbs-europe.com>
Subject: Urgent Inquiry and Purchase Order
Attachment: quote.iso (contains "overbygningerIMG048163134.com")

GuLoader payload URL:
https://onedrive.live.com/download?cid=547B1E4A6B15BF97&resid=547B1E4A6B15BF97%21106&authkey=AKgsMZqhemioz8g

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 11:42:06 UTC
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wbbk4ug2x3exwyzsoctrs622tosy677u2z722luvqvozabf7ygla._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso b042ae50dabec97b633270a7197b5a9ba58f7ff4d67fad2e95855d9004bfc196

(this sample)

GuLoader

Executable exe ea4512d4bec0674059c55c5861d977bab515b6d28a543c74f32e1d78126625a4

  
URLhaus
https://urlhaus.abuse.ch/url/385300/
  
Dropping
MD5 99a58ac63a8451703547dbbf81d0a966
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ea4512d4bec0674059c55c5861d977bab515b6d28a543c74f32e1d78126625a4

Comments