MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb5b06a3e0354be2ee676f892ae5b9a681bd0db5163fac4c8376d7c1b29cf761. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb5b06a3e0354be2ee676f892ae5b9a681bd0db5163fac4c8376d7c1b29cf761
SHA3-384 hash: 34fd8bcaa88b9530f754eda5486b47517497960e8754c929f73a2967efbe01d06f7d66cf9d41774bc547196df27b1108
SHA1 hash: 2eebfc1b4b6f7bac8319499fdbf8498085b47998
MD5 hash: fcc8d704489407044368f5dccc2d0e58
humanhash: jersey-salami-fourteen-hawaii
File name:NEW PO ORDER.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:38'939 bytes
First seen:2020-06-02 10:59:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:xn049/8rPCLRdaZGW94yhntGwvUrSobewrDQGLxu7JpI52c:S4KrCL6ZGWftJ9obHrDQ+Ek52c
TLSH B203F16FAD5E4192FA7643FAA00198C8570461876DAF1366C49C0A1F6A0EEC19E8CF49
Reporter abuse_ch
Tags:GuLoader gz


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: vmi300166.contaboserver.net
Sending IP: 144.91.70.17
From: bijay@bnstaccountants.com
Subject: New june Order PO
Attachment: NEW PO ORDER.gz (contains "NEW PO ORDER.exe")

GuLoader payload URL:
httpW@hhrem

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 00:51:34 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5nnqni7agvf6f3thn6esvznzu2a32dnvcy72ytedo3l4dmu465qq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip eb5b06a3e0354be2ee676f892ae5b9a681bd0db5163fac4c8376d7c1b29cf761

(this sample)

GuLoader

Executable exe d3e8b7ec008c3b5a14ac57fe76b4a53eb4a1b90ab28d38effd051317b2a9fea7

  
Dropping
MD5 93d66bc7683da401fdb0142f01190529
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d3e8b7ec008c3b5a14ac57fe76b4a53eb4a1b90ab28d38effd051317b2a9fea7

Comments