MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9ecb53aed5a387083ae08c59a31fa34ddf4ee4b45bca416b413f3a98e5fc465. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9ecb53aed5a387083ae08c59a31fa34ddf4ee4b45bca416b413f3a98e5fc465
SHA3-384 hash: 78fb779656aeaaf4c8ce1ba09c8c625e7cfbe5c21db02ed3b1fb4e634be13071d345784bd8f024c839c9747b65c7aacc
SHA1 hash: 856a9655200c55ee47e7650d72149a1219a15a76
MD5 hash: 246475a1934a87f82f3eac3a7883c36b
humanhash: golf-maryland-sink-mississippi
File name:Purchase order catalogue for new shipment_pdf.arj
Download: download sample
Signature GuLoader
Create hunting rule
File size:46'302 bytes
First seen:2020-06-02 10:59:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:bSVxPi70jPQUwZITadOImSSCTFMD1fGXIDeXvHLll2Tnw+sPnlItJEL8IARg:bYigcj6adOIJSQFU1p2H/+sPlSJS8IAS
TLSH D52302CD644ED773E89B76CF2980F346ECAF44022D79D7826E4030016519461DBB8FAE
Reporter abuse_ch
Tags:arj GuLoader


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: s1.smallhost.in
Sending IP: 103.46.239.70
From: Peter.Mahlangu@temoc.co.mz
Subject: NEW PURCHASE ORDER FOR SHIPMENT
Attachment: Purchase order catalogue for new shipment_pdf.arj (contains "Purchase order catalogue for new shipment_pdf.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1emdeFT0ppBWGwMGoh2tGfD7cpkKDTuPU

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.24764.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vbkrypt
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 08:51:15 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zhwlkoxnli4hba5obdczump2gto7j3sliw6kifvucpz2tds7yrsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip c9ecb53aed5a387083ae08c59a31fa34ddf4ee4b45bca416b413f3a98e5fc465

(this sample)

GuLoader

Executable exe 4cab1aacfb805a94301d5f14ff07c8a4c07cef2b81897c19fd35a04c5cfe2b68

  
URLhaus
https://urlhaus.abuse.ch/url/374145/
  
Dropping
MD5 148887411f12fd96d5762e557fff4301
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4cab1aacfb805a94301d5f14ff07c8a4c07cef2b81897c19fd35a04c5cfe2b68

Comments