MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b113e8f35553dbbbe42ffe8dafde4a136114ca4f7804f62be26d8a93cf277b01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b113e8f35553dbbbe42ffe8dafde4a136114ca4f7804f62be26d8a93cf277b01
SHA3-384 hash: ac36c0bb1cfbef3167f26972c02481d98e0d775c9a116fa9f4f0fd3dbddee63c1b817156c972e6254841b7a06135e13b
SHA1 hash: fd69e9984c8145c7c66886e5f9084c0748454727
MD5 hash: 1ffd906a163f7a9d8812a4abfaff3b8a
humanhash: three-mockingbird-fruit-alpha
File name:PO.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:24'559 bytes
First seen:2020-08-05 08:30:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:PcEO1013DMENb08UgZBtKjbpbiYhoImfaQxNgruTUSSdZdhtTshoYfny6H4YGx7:PcvhEG8RZBojdDxuzx4yVWRkyK4YA
TLSH 71B2E1C144C2FE99E93F2579C41D981937499F4F180720DE39F85CA39BB2622DE0E292
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: alibcompositeltd.pw
Sending IP: 104.168.190.254
From: "ART IMPEX GROUP LLP" <info@alibcompositeltd.pw>
Subject: RE: New Purchase Order
Attachment: PO.zip (contains "PO.exe")

GuLoader payload URL:
http://anakleather.ir/chukwukaa_pYDreKwXV241.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21241.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b113e8f35553dbbbe42ffe8dafde4a136114ca4f7804f62be26d8a93cf277b01/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 04:02:15 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wej6r42vkpn3xzbp72g27xskcnqrjssppacpmk7cnwfjhtzhpmaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b113e8f35553dbbbe42ffe8dafde4a136114ca4f7804f62be26d8a93cf277b01

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip b113e8f35553dbbbe42ffe8dafde4a136114ca4f7804f62be26d8a93cf277b01

(this sample)

GuLoader

Executable exe 0e5007396123f9b1a018685b7cf2e42cc508b58ab216df305808f65408f21388

  
URLhaus
https://urlhaus.abuse.ch/url/424600/
  
Dropping
MD5 198b59cdc034f2191632c922d7f899ca
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0e5007396123f9b1a018685b7cf2e42cc508b58ab216df305808f65408f21388

Comments