MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb6d17b09337214998c5997114dffa7b97b06ab9620710eea47f0648d1470a59. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb6d17b09337214998c5997114dffa7b97b06ab9620710eea47f0648d1470a59
SHA3-384 hash: ef30755ba2425f659d3b04e23117f80875c28c5a73263befe9924a44f130e76310f1553ac5683916c066e94606a72280
SHA1 hash: 7fca0a0196d1e1011443c7e787c401ee63d72446
MD5 hash: ac32e78859c7b0d1bd0bace5b9b8569d
humanhash: yellow-zulu-kansas-friend
File name:Scan_05-06-2020.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:48'653 bytes
First seen:2020-06-05 19:34:26 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:bVlUzPE/uW9SlnhEiN9FOhnMA0XrrFplfAzBFMu4mk+E/TnIORfg5Mgo6:bVlG2KnXF0MAErriz4Fmk+E/zBg46
TLSH 7A23F193817EF3738E4D4E508B1B58EDCAB60F8E898B9A0C3AD8AD45D18D9E534C6650
Reporter abuse_ch
Tags:GuLoader rar


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: linux3.webarisi.com
Sending IP: 91.227.6.13
From: Accounts payable<kadir.mungan@ekonsismuhendislik.com>
Subject: Invoice_reconfirmation
Attachment: Scan_05-06-2020.rar (contains "Scan_05-06-2020.exe.exe")

GuLoader payload URL:
https://djmixers.co/tb_AiPcefoaqs189.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 19:36:06 UTC
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7nwrpmetg4qutggftfyrjx72pol3a2vzmidrb3vep4derukhbjmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar fb6d17b09337214998c5997114dffa7b97b06ab9620710eea47f0648d1470a59

(this sample)

GuLoader

Executable exe 6f06cf7295e9301a4358854569f7d53dcf77319a94a76b45e60ebc72b88c2087

  
URLhaus
https://urlhaus.abuse.ch/url/382352/
  
Dropping
MD5 0d731fe5cdbb558f08306fd812e3ddaf
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6f06cf7295e9301a4358854569f7d53dcf77319a94a76b45e60ebc72b88c2087

Comments