MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6f85be0f3562d7dbaab9197bba92e32b5876f02f3de35ced3c923c89a1a9f94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6f85be0f3562d7dbaab9197bba92e32b5876f02f3de35ced3c923c89a1a9f94
SHA3-384 hash: 760d9758b43f705a050be026e002b5bf193a794a020b7e852b78a74393e24aafbdb00873bd79ebf1b55bd27897ff9146
SHA1 hash: f74b8df2b51118a668b5e925ccce98ac9df282fa
MD5 hash: f69a4728fb2badce322c7dcb0cec22bb
humanhash: hydrogen-bluebird-michigan-lion
File name:New order.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:43'774 bytes
First seen:2020-06-02 11:12:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:PCSht5xSpH/wPud86e8dUgKrwyAMC4AdeSHPrnm2Xq8YqaN2jyxEaPVZkCC7+zC5:Kmxv883SUgYwz34evrdXGqaN2jsNPVZY
TLSH AC13020B8D6E4AE25FE1A76A26D858414F81E8D142ED31EB634FCFE7AA0D136148149F
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: hanmail.net
Sending IP: 176.99.9.245
From: Churn, Suk Hyun <cchoijwj@hanmail.net>
Subject: New Order
Attachment: New order.rar (contains "New order.exe")

GuLoader payload URL:
http://195.54.163.83/obi_SDYHNUh142.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vbkrypt
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 02:44:00 UTC
AV detection:
13 of 31 (41.94%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=234fxyhtkywx3ovlsgl3xkjogk2yo3yc6ppdltwtzer4rgq2t6ka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar d6f85be0f3562d7dbaab9197bba92e32b5876f02f3de35ced3c923c89a1a9f94

(this sample)

GuLoader

Executable exe 5296cea8fcdd8e9d851cf4b653273adb32e4bf9e3dde631d861aaae3f4eeb778

  
URLhaus
https://urlhaus.abuse.ch/url/374410/
  
Dropping
MD5 edff1804775be0694a09d845504e8ec2
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5296cea8fcdd8e9d851cf4b653273adb32e4bf9e3dde631d861aaae3f4eeb778

Comments