MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cba222ed0c40791ea4fec30a7438e2a893a95ebff1485fa97118e91f856d0c68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cba222ed0c40791ea4fec30a7438e2a893a95ebff1485fa97118e91f856d0c68
SHA3-384 hash: 5e21ac91d5bc6a166bcea9609b8f48cc20034e20b4d420c2cd43bdeec75fda3f4094a9a77633b96361bd5d2ea14fef3b
SHA1 hash: 414c60b1b6f1d9d9bbc38371b589e18ab6dec40f
MD5 hash: 8fc636ad209352934b19874d6622601d
humanhash: mississippi-muppet-mountain-beer
File name:AES_AUS No. 0008_pdf.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:28'833 bytes
First seen:2020-10-26 14:02:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:13kkX7/IoHBTa3qGoZrCkgQdM2t3YMJ50PtfTXq+VYYc7rCkFKi47:CkrIcha3qxZrCZkLabq+Kr3oi47
TLSH 16D2E1B2E02C12B6C0C7262821C7619480BE567B91BA68DD7D7C839F0B46F5C296D6CA
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: xwx0.320.xoron.ml
Sending IP: 159.89.137.248
From: Business Development Dept.- EVEREST PHIL <purchase@aesolutions.com.au>
Subject: REVISED PO - AES_AUS No. 0008
Attachment: AES_AUS No. 0008_pdf.rar (contains "AES_AUS No. 0008_pdf.exe")

GuLoader payload URL:
https://redesuperpops.com.br/trends/Kalied_Rewcur216.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cba222ed0c40791ea4fec30a7438e2a893a95ebff1485fa97118e91f856d0c68/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 08:28:39 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zorcf3imib4r5jh6ymfhiohcvcj2sxv76fef7klrddur7blnbrua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar cba222ed0c40791ea4fec30a7438e2a893a95ebff1485fa97118e91f856d0c68

(this sample)

GuLoader

Executable exe f0b159a704857b45d6336160191150963d48aa792341b9a38834fb99881c8d31

  
URLhaus
https://urlhaus.abuse.ch/url/750731/
  
Dropping
MD5 36ef7011d14bf40997d50ad4620fe4f4
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f0b159a704857b45d6336160191150963d48aa792341b9a38834fb99881c8d31

Comments