MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bbc268c28afd1d47a4f7597d28f54af3f2f2d6672c7722881904de42ebf8303d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bbc268c28afd1d47a4f7597d28f54af3f2f2d6672c7722881904de42ebf8303d
SHA3-384 hash: 0166c5f3581ef6a8c5552608e4cd3d91fd23223f987454a4b7978a11077244222bba7f75ffd00febc0a763fea2a85762
SHA1 hash: 02563608e4467656acf20b4f150ce9cbeace9c31
MD5 hash: 8a0c5fc1936700d054a6ec5ae1a91601
humanhash: zebra-beer-equal-november
File name:New Order_0610202010256.iso
Download: download sample
Signature GuLoader
Create hunting rule
File size:135'168 bytes
First seen:2020-06-10 17:28:54 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 1536:aY94d4xRfZai6d1CvJ7rbSV1WstxWrNOGMO24DEL8bG:H4dmAld8lXSzreG
TLSH C5D34A2EDB18D483E0240670447246A0A2577D4B656F5D1BB94D3A2B0B73E13BAE7B3F
Reporter abuse_ch
Tags:GuLoader iso


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: distribucionesduch.acens.net
Sending IP: 176.28.110.186
From: Sandra Martinucci <sandra.martinuccii@moby.it>
Subject: Urgent seafood product need
Attachment: New Order_0610202010256.iso (contains "New Order_0610202010256.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1wi6pa5EPCFtC1H_oM0QfzQYbYPYigtE2

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CLASSIC.30373.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 17:30:14 UTC
AV detection:
16 of 30 (53.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xpbgrquk7uoupjhxlf6sr5kk6pzpfvthfr3sfcazatpef27yga6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso bbc268c28afd1d47a4f7597d28f54af3f2f2d6672c7722881904de42ebf8303d

(this sample)

GuLoader

Executable exe 1faaeabc23e415ec50a9fb89feaf02f6571f9c29cc086dd465e464c6f62fab73

  
URLhaus
https://urlhaus.abuse.ch/url/385859/
  
Dropping
MD5 54f56b53e69a3e491de3b6a4d8b0bb51
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1faaeabc23e415ec50a9fb89feaf02f6571f9c29cc086dd465e464c6f62fab73

Comments