MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e281c97dc70a8e1a4d21ba637bb330e30e775fef444048a4c2aab503b21dfb85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e281c97dc70a8e1a4d21ba637bb330e30e775fef444048a4c2aab503b21dfb85
SHA3-384 hash: 1fb5e0893d0b5e52c34cf40b3b1fe5ef45e4cc4c63ef0db789aff7806e06a7778b82dd289ec8dfbe4ba5a24a116ffb0e
SHA1 hash: 23a574c97a330341b93932d29c01426bba268560
MD5 hash: 9a0d73513c453369b3ee8679cd553805
humanhash: missouri-pennsylvania-carolina-avocado
File name:Invoice DFC-6546735_pdf.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-23 11:50:05 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:K2+s6bkgowLu+W+lsmThzaQ33DQDWuAY:f6kgGr+hBj+6Y
TLSH FA456F17B50DCBADE6148AB2F57042F01679AF2BE891192BF9CDFE2C377114C26112E6
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: smtpout37.sweb.ru
Sending IP: 77.222.41.66
From: Andrea Perry <sales@mogindustries.tech>
Reply-To: sales@mogindustries.tech
Subject: Re:Overdue Invoice DFC-6546735
Attachment: Invoice DFC-6546735_pdf.img (contains "Invoice DFC-6546735_pdf.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1w-k0OqNANbahCjQzopaGUIFRUsC1kHMN

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.791968.4656.20149.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-23 12:36:42 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img e281c97dc70a8e1a4d21ba637bb330e30e775fef444048a4c2aab503b21dfb85

(this sample)

GuLoader

Executable exe 85da31a80a4d9abbb63b08026620b12410c1865fdc8399c283af3bbfbddfd4f6

  
URLhaus
https://urlhaus.abuse.ch/url/367036/
  
Dropping
MD5 f415bb90f50b609f1d477e066b6b8d93
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 85da31a80a4d9abbb63b08026620b12410c1865fdc8399c283af3bbfbddfd4f6

Comments