MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e58e12ddfcc0bf623d05a6e194f268b92dc8580b54c7a53b918c26fec453b28c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e58e12ddfcc0bf623d05a6e194f268b92dc8580b54c7a53b918c26fec453b28c
SHA3-384 hash: 1b643b9295694e8453cb5dd3a5df2f963ce5453c2b68a505563b3bd73e80bec4913676deade7ea0f4295a8a9aeac3aa5
SHA1 hash: 566e98fdd9656453b5def7fadf6841123c5d0924
MD5 hash: b3a146cdb13f34a1671344d316dcbd91
humanhash: finch-six-robin-juliet
File name:Quotation List.lha
Download: download sample
Signature GuLoader
Create hunting rule
File size:30'618 bytes
First seen:2020-06-10 06:49:49 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:AEhkYMMeL00YS97Uzl3OJ8RaFba4qS6o3OsNisnW:xuNBL00Y07s3Lp4qnsNisnW
TLSH 69D2E1CAF16793361150E3A91173CE2CBAF6F97982C05CB687094A0D56830A7FE93685
Reporter abuse_ch
Tags:geo GuLoader lha Outlook THA


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: APC01-PU1-obe.outbound.protection.outlook.com
Sending IP: 40.92.254.28
From: หน่อย วงศ์รัตนโชคชัย <noichuthamas@hotmail.com>
Subject: QUOTATION LIST.
Attachment: Quotation List.lha (contains "Quotation list.exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1JGS3tJpF4W4RJEnPGmQp2ufJI6ZRJ9Mh

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 06:51:06 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4whbfxp4yc7wepifu3qzj4tixew4qwalktd2ko4rrqtp5rctwkga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar e58e12ddfcc0bf623d05a6e194f268b92dc8580b54c7a53b918c26fec453b28c

(this sample)

GuLoader

Executable exe 4320e2bf2bc6115ae79a52777bdd9aef62db691a756640f9c7fa6e8372e46193

  
URLhaus
https://urlhaus.abuse.ch/url/385263/
  
Dropping
MD5 f2866779247dba8e3003395b74c0c0c7
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4320e2bf2bc6115ae79a52777bdd9aef62db691a756640f9c7fa6e8372e46193

Comments