MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb78a9e5690371b4d4472c0cb6e0d8145456264cf094df7c66b280a1d2f18f9d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb78a9e5690371b4d4472c0cb6e0d8145456264cf094df7c66b280a1d2f18f9d
SHA3-384 hash: 6aac98ab6121ce13e9740606f7b03a594edefc081ccd0473e874f1a7cf629861bb987e368d5c59a11c76739ee36188af
SHA1 hash: c83106d8d37a9d90b7b7fedb784ea01866a0e07c
MD5 hash: 6274126ae818216c95698118085afdc4
humanhash: kentucky-cold-pip-shade
File name:견적 품목 리스트.lzh
Download: download sample
Signature GuLoader
Create hunting rule
File size:40'144 bytes
First seen:2020-06-09 06:30:46 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:vuiuezPFBaW5suFh4coxRh/2rUHFhnPrWyU9Zx6ujqqS4dG7Q46k9/hqFuMC0Cgv:vuiHmWRtoJ/WEZPnU9Zx6Pq9GUmJ+2tU
TLSH DD03F2AF5F3A04986054FBA2C8FA91AC44F770DC73DE16EF854818B16225B65C37394D
Reporter abuse_ch
Tags:geo GuLoader KOR lzh


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm49.hanmail.net
Sending IP: 203.133.180.237
From: 미르 <miru104@hanmail.net>
Subject: 첨부도면 견적요청 드립니다.(한석이엔지 입니다.)
Attachment: 견적 품목 리스트.lzh (contains "견적 품목 리스트.exe")

GuLoader payload URL:
https://onedrive.live.com/download?cid=809F316B561D99CA&resid=809F316B561D99CA%21175&authkey=AHjVAhLb3L8b4LQ

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 06:32:05 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5n4ktzljany3jvchfqglnygycrkfmjsm6ckn67dgwkakduxrr6oq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar eb78a9e5690371b4d4472c0cb6e0d8145456264cf094df7c66b280a1d2f18f9d

(this sample)

GuLoader

Executable exe 229d8d98a701a24e93b4e374092a5ce767fb859ffbc243cea9c1486b871dd4fb

  
URLhaus
https://urlhaus.abuse.ch/url/378994/
  
Dropping
MD5 0aa5233594f53e35cb2c123f43642905
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 229d8d98a701a24e93b4e374092a5ce767fb859ffbc243cea9c1486b871dd4fb

Comments