MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dbcb863c6ff9e121d295b9aaa03de85655e0e7d4bd51105bf6471cde554cffac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dbcb863c6ff9e121d295b9aaa03de85655e0e7d4bd51105bf6471cde554cffac
SHA3-384 hash: 4bc71dd3f4e31b9d300fc703515bfbc093940f41baa666f8a390e9effe1df5daf519b0a8bd913dba6495a6721974ce9e
SHA1 hash: 05e1dcc4cfa51dc534ff10215f2e7a125e5fee78
MD5 hash: c9299dcf6dc1dc6aed91f592cbd684fc
humanhash: yankee-lemon-carolina-echo
File name:specified items for order.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:24'605 bytes
First seen:2020-08-13 06:48:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:JAXPvknKciFKzkzaqJaDWcxeSE9JhgOm4ee9MRbA1r1KmODqRc8YVr1REzicMU1z:MFKktJaDWcESQgAMRby28Y51Sn
TLSH DBB2F1847EA8306152D686736F0C20D498BDA4ED4E67637413BCEE07E7843F21DE5570
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: sabisl-bd.com
Sending IP: 156.96.44.186
From: SAB INDUSTRIAL SOURCES LIMITED<sales-support@sabisl-bd.com>
Reply-To: steviebmbb@gmail.com
Subject: Specification Inquiry Request / Provisional Order
Attachment: specified items for order.zip (contains "specified items for order.exe")

GuLoader payload URL:
http://ezvizlife.lv/wp-includes/ID3/bin_HwDEDU10.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dbcb863c6ff9e121d295b9aaa03de85655e0e7d4bd51105bf6471cde554cffac/
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 01:40:06 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3pfympdp7hqsduuvxgvkappikzk6bz6uxviraw7wi4on4vkm76wa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/dbcb863c6ff9e121d295b9aaa03de85655e0e7d4bd51105bf6471cde554cffac

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip dbcb863c6ff9e121d295b9aaa03de85655e0e7d4bd51105bf6471cde554cffac

(this sample)

GuLoader

Executable exe 8ce05a475d373e53e20a6e354cb258a121f737cb8b37192b0567f958b2dce822

  
URLhaus
https://urlhaus.abuse.ch/url/431585/
  
Dropping
MD5 2e5cf8c9ff6fd4b68a998e3718083609
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8ce05a475d373e53e20a6e354cb258a121f737cb8b37192b0567f958b2dce822

Comments