MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5af9957f7480e1c0d19588d0cb7cb70e055783fb4f092f73daca0c6dbf1f953. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f5af9957f7480e1c0d19588d0cb7cb70e055783fb4f092f73daca0c6dbf1f953
SHA3-384 hash: 214f860824353b61c43d25c2c2a96101e0a008446c8752ded1dcca80988b625d26571fb603049a2371c610b49ec83efb
SHA1 hash: d09d81313db1902a6c22319c760f026b5c313c6a
MD5 hash: 793b46e116a1817e8810e67f26f175bb
humanhash: echo-september-stairway-lemon
File name:NEW EXPORT ORDER ITEMS FOR PURCHASES 58.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:34'043 bytes
First seen:2020-06-10 12:34:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:mbwTEnLi+qxf+H/2cexs0L0qEev31w6Qboy3KNapZq4CjURo:m8wnL5qxuH9qEev3+nboy6NapY4CwRo
TLSH 78E2F1A41D3AFF82AE31A29404D48B507F98C4ABC9E35194EB34E1354B724D907FE735
Reporter abuse_ch
Tags:GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: exportraction.com
Sending IP: 199.127.103.228
From: Kelly from Export Group <market@exportraction.com>
Subject: Please send PI for another order from our customer !!!
Attachment: NEW EXPORT ORDER ITEMS FOR PURCHASES 58.zip (contains "NEW_EXPORT_ORDER_LIST_FOR_PURCHASE_JUNE-10-6-2020.bat")

GuLoader payload URL:
https://onedrive.live.com/download?cid=8CA507BAA15FDB5C&resid=8CA507BAA15FDB5C%21184&authkey=AEEk7OfGuvSjqwE

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Injector.EMIT.30476.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 12:36:09 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6wxzsv7xjahbydizlcgqzn6lodqfk6b7wtyjf5z5vsqmnw7r7fjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip f5af9957f7480e1c0d19588d0cb7cb70e055783fb4f092f73daca0c6dbf1f953

(this sample)

GuLoader

Executable exe f83a6bef755f005fcc8ac28da9b41ab4aa94d06d43543b7dfef4ff157b75226e

  
URLhaus
https://urlhaus.abuse.ch/url/385332/
  
Dropping
MD5 f344905d6896b19da198f98737a31e84
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f83a6bef755f005fcc8ac28da9b41ab4aa94d06d43543b7dfef4ff157b75226e

Comments