MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fcb0838146fd2198d576448733cdf6f1e54c76c6b03dec6f079be9f6aa9867b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fcb0838146fd2198d576448733cdf6f1e54c76c6b03dec6f079be9f6aa9867b3
SHA3-384 hash: 555df63f5fe090d0a5084699023a31e81f8c63872fd0c50858a493f0822b71b9b94ca63a2b4310fab6a1c489067c2d4b
SHA1 hash: 24b378efd62e08415f1ef0ab6e98fb5f944624d8
MD5 hash: 06e2cf99980d455822e5a570f15a4aca
humanhash: four-network-blossom-ink
File name:HYUNDAI MASS QUARANTREAT PROJECT.cab
Download: download sample
Signature GuLoader
Create hunting rule
File size:41'111 bytes
First seen:2020-06-02 11:22:07 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 768:XCcq1E3YHjQCKIOY1dOJ5aTJfMShh8bQ1pzF9pfNXEm1CNytCEBZ:XwIk1QJs9Ey8bQvJfNEzqCaZ
TLSH 4503F18582FDD44BE39B031A1564C98731D3C07C869BBD484E2AFE37D9752825506F5F
Reporter abuse_ch
Tags:cab geo GuLoader KOR


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: mail-smail-vm29.hanmail.net
Sending IP: 203.133.180.213
From: 로이 유 <acc6464@daum.net>
Subject: 견적요청의 件:HYUNDAI MASS QUARANTREAT PROJECT
Attachment: HYUNDAI MASS QUARANTREAT PROJECT.cab (contains "HYUNDAI MASS QUARANTREAT PROJECT.exe")

GuLoader payload URL:
http://ekenefb34logs.webredirect.org/uploud/5bab0b1d864615bab0b1d864b3/lento_SlyRKZz40.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vbkrypt
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 11:37:52 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7syihakg7uqzrvlwisdthtpw6hsuy5wgwa66y3yhtpu7nkuym6zq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

cab fcb0838146fd2198d576448733cdf6f1e54c76c6b03dec6f079be9f6aa9867b3

(this sample)

GuLoader

Executable exe 4359188e33f22ea7022cb6e57a3870f2613a1c37dbc483475e02b38cde5bfa8e

  
URLhaus
https://urlhaus.abuse.ch/url/374153/
  
Dropping
MD5 e974de3839e20efc2dbc6bc2ad362f5b
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4359188e33f22ea7022cb6e57a3870f2613a1c37dbc483475e02b38cde5bfa8e

Comments