MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8d4b9824bc3eb42414f395e49992055d69c63741b9a4b4579de378f5e41842f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8d4b9824bc3eb42414f395e49992055d69c63741b9a4b4579de378f5e41842f
SHA3-384 hash: b0479b5e7ca5058cb0ad58e0b05dcceb97a4e5ff4d04f839d3d3cddea2ef64a8f2ac5623d17511cec24f390df35e9c34
SHA1 hash: 242c2cb9992bdb1fada4bb8fbe53ee666b3d2290
MD5 hash: cadcaa669c870f27c1d5a0b52102c366
humanhash: apart-social-spring-papa
File name:URGENT REQUEST FOR QUOTE.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-26 07:20:20 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:n/R6jvjUzMJbL41nCSXj0JTqPY9IHok6VAmLCg65aT:/gjLGMe0Szw2zHAg
TLSH 64451BE1F1E0503BD273FE709E7282D441BA7DBC2609945B3B5C358A077DA04EA6962B
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail.huclangia.tk
Sending IP: 64.52.175.227
From: Paul Runyan <slim@huclangia.tk>
Subject: URGENT REQUEST FOR QUOTE
Attachment: URGENT REQUEST FOR QUOTE.IMG (contains "ORDER.exe")

GuLoader payload URL:
http://37.72.175.206/bin_JNPcC154.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.43223325.26075.7040.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 04:06:44 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
15 of 48 (31.25%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img c8d4b9824bc3eb42414f395e49992055d69c63741b9a4b4579de378f5e41842f

(this sample)

GuLoader

Executable exe 8556575140ee35421e573d86cf9e34e1062e3e6718e7c7b0059de1502b6d6d61

  
URLhaus
https://urlhaus.abuse.ch/url/368679/
  
Dropping
MD5 005eb0c24aad00338e5003fb791b6bea
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8556575140ee35421e573d86cf9e34e1062e3e6718e7c7b0059de1502b6d6d61

Comments