MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f56ecb5ef74945b643d85c7f7109d37ceba2fd21d685c60bc4aa77d61d3b7461. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f56ecb5ef74945b643d85c7f7109d37ceba2fd21d685c60bc4aa77d61d3b7461
SHA3-384 hash: a68d642010b656cb9dab4e6117b70ce400b0a0bc6db0c94c653f86c3703e884b83ecd25c57e28d0a8d43952deb37826d
SHA1 hash: b33cc5bfec9ce2ceeedacdf5c3226fccc8b6d412
MD5 hash: 0af47b3cd0c21721e4b99934841b1e8a
humanhash: fifteen-kansas-asparagus-yankee
File name:PO.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:24'551 bytes
First seen:2020-05-28 18:05:46 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 384:LXxTA2d5cDFJ+Sct405HyS/LiMbwP8Z1uP5m06IZKWbs9uSlMyDVqTdpt+RKUpUC:Tx0gDSc5HHWMbwa1XIsWbqJVqjiUJDqZ
TLSH 3DB2D1F7C93FD3580F70E44354119208C0E36596536A1D78256E825B2BE396A9A778FC
Reporter abuse_ch
Tags:GuLoader gz Outlook


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: NAM04-SN1-obe.outbound.protection.outlook.com
Sending IP: 40.92.11.49
From: silvio quevedo <squevedo2008@hotmail.com>
Subject: SOLICITUD DE PRESUPUESTO
Attachment: PO.gz (contains "PO20200529.bat")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1xy4fixMFmEaSP1Ox278dy7GTKJzp1tS2

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vbkrypt
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 18:37:02 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

gz f56ecb5ef74945b643d85c7f7109d37ceba2fd21d685c60bc4aa77d61d3b7461

(this sample)

GuLoader

Executable exe 9b727d12d8d7a5568f0e1e4aa4d5e50365e7de1a213f672c68db74aae0f68246

  
URLhaus
https://urlhaus.abuse.ch/url/371343/
  
Dropping
MD5 1ae535bc1fa595327000ca40aad41fad
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9b727d12d8d7a5568f0e1e4aa4d5e50365e7de1a213f672c68db74aae0f68246

Comments