MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb1346d4ccf83bd8aad753c60c74d2563354a369f35d0fc0945025b614917a43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb1346d4ccf83bd8aad753c60c74d2563354a369f35d0fc0945025b614917a43
SHA3-384 hash: c65d3961f949078a50c84d79766fd29647a858ce466836a2b858f4f6c50a1d60c6efba7b24d0b03df8d5016170b66e4e
SHA1 hash: ffe282d1e35d3f4f32b76047385e23310e50cf1c
MD5 hash: 829d4e7444d497594a8d91fb8fee52ab
humanhash: victor-berlin-social-venus
File name:Doc726372837293 pdf.iso
Download: download sample
Signature GuLoader
Create hunting rule
File size:151'552 bytes
First seen:2020-06-05 19:34:29 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 1536:YGKDrdLtwBn1+HZShg2Y/wDwvUMiznTPzih2mbr0XYd:YnrdhYgyE7iznTL3oh
TLSH F2E319136C299D25C0952EF17C67A85627076C10BB601A6F328CEFBDF7725E23C6970A
Reporter abuse_ch
Tags:GuLoader HSBC iso


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail.bengiamein.gq
Sending IP: 64.190.95.156
From: HSBC Advising Service <admin@bengiamein.gq>
Reply-To: kimhilary164ever@gmail.com
Subject: Ref: [GB987338373] / Priority payment / Customer Ref:[6928373D00117]
Attachment: Doc726372837293 pdf.iso (contains "Doc726372837293 pdf.exe")

GuLoader payload URL:
http://immigratsiya.info/bin_DJIkWD59.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CLOUD.26344.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 19:36:08 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xmjunvgm7a55rkwxkpday5gskyzvji3j6noq7qeukas3mferpjbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso bb1346d4ccf83bd8aad753c60c74d2563354a369f35d0fc0945025b614917a43

(this sample)

GuLoader

Executable exe 17653f0b95df006bc5833a71a7cedaf0210ab2dd9c913104576b4823c8f7cdfd

  
Dropping
MD5 17cb70c65f3d9ecd45b94443085db16a
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 17653f0b95df006bc5833a71a7cedaf0210ab2dd9c913104576b4823c8f7cdfd

Comments