MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6ff58d06a8a42653960581d2d011904d583fa19ef1cbf5ecf2a9a728b3f1bad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6ff58d06a8a42653960581d2d011904d583fa19ef1cbf5ecf2a9a728b3f1bad
SHA3-384 hash: 7498d1af4fba3260b485d44b5a5e8d7990cc8ac5ddd14d6f3b36ae8e886d0fa770744974560544e914b32ff9ef2db357
SHA1 hash: 0d2c90208fcf04ca7bcc0c60fa44a3964f417b67
MD5 hash: 3df4e187ed45dd3b6f94284b7eaa77a7
humanhash: fish-crazy-oregon-avocado
File name:ups.img
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-24 07:01:36 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:2I9pnn4Hw2Rfq3bbiU93tpPaxcOSYEModhu7QWtXt1nQObsJ0:J9l4Hh9UZ3tprVMeM7QQXtZQOo0
TLSH 1845D6A671F08D72E87C4FB11DF69EA81E2ABE5569000B17398CFF5D6B372882D61704
Reporter abuse_ch
Tags:GuLoader img UPS


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: giant-monkey
Sending IP: 112.213.32.15
From: UPS <support@ups.com>
Subject: Dear Customer
Attachment: ups.img (contains "ups.exe")

GuLoader payload URL:
https://www.sendspace.com/pro/dl/dnmacp

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.GenKryptik.ELBA.14420.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-24 07:35:51 UTC
File Type:
Binary (Archive)
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img f6ff58d06a8a42653960581d2d011904d583fa19ef1cbf5ecf2a9a728b3f1bad

(this sample)

GuLoader

Executable exe 5ecd51e9131fb350b5fe5b90e4e4ebd71a28a55ca867399f231995e25097da58

  
URLhaus
https://urlhaus.abuse.ch/url/367192/
  
Dropping
MD5 b8a5fb46dd611bebba61aae627035317
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5ecd51e9131fb350b5fe5b90e4e4ebd71a28a55ca867399f231995e25097da58

Comments