MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2415967dc60b1baf84375e31ba7c6bf269b75d4c344b0d0dc16868ef234fbf0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d2415967dc60b1baf84375e31ba7c6bf269b75d4c344b0d0dc16868ef234fbf0
SHA3-384 hash: e60ff64ca960340d89f5bb952790a6babfed336a26161acb3a6a05ae1c6b972e33cddf5905149d7fce7d5d2e48794c73
SHA1 hash: 60919da935b62c77087f533fdf76587cc6733573
MD5 hash: edfad87140091bcf462047edf5e246d9
humanhash: bravo-uranus-xray-avocado
File name:SGN07752817.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-17 08:57:37 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:sTAA3EW1FqPLE0Z+WexqdJ/Dvk16Z+PvWtfqvQID8co/1q2UnlalRE:pA3j1t0MWexq3ET4CvKcoXUlalR
TLSH 96453B12A3989336F378CAB50A7652B7517EEC3065068A0736DC3A767BB3E04CB21757
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: slot0.brainsse.com
Sending IP: 104.168.146.60
From: "ppa. Thomas Rawe'' <info@brainsse.com>
Reply-To: thomasrawe@kraftcurring.com
Subject: Price request
Attachment: SGN07752817.IMG (contains "SGN07752817.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=8E778D4A23C91A07&resid=8E778D4A23C91A07%21261&authkey=AI0LHTXwXXBaZf4

Intelligence

File Origin
# of uploads :
1
# of downloads :
216
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Bulz.49349.22641.31701.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d2415967dc60b1baf84375e31ba7c6bf269b75d4c344b0d0dc16868ef234fbf0/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 03:19:55 UTC
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2javsz64mcy3v6cdoxrrxj6gx4tjw5ouynclbug4c2di54ru7pya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d2415967dc60b1baf84375e31ba7c6bf269b75d4c344b0d0dc16868ef234fbf0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img d2415967dc60b1baf84375e31ba7c6bf269b75d4c344b0d0dc16868ef234fbf0

(this sample)

GuLoader

Executable exe d74cc19807af42ec11e67655ce7494041057b895d88bcfe15d90afa114a7eabc

  
URLhaus
https://urlhaus.abuse.ch/url/434381/
  
Dropping
MD5 aed3e2f237d6061507dd8809128b0d94
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d74cc19807af42ec11e67655ce7494041057b895d88bcfe15d90afa114a7eabc

Comments