MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe26a5b78f23eb3801148d0de982489d97fe73c4e9b0d6d3fc80040f6c15aa82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe26a5b78f23eb3801148d0de982489d97fe73c4e9b0d6d3fc80040f6c15aa82
SHA3-384 hash: 2785c2b6df4e82e8d5f68badc5cf9b9b20c8b068c4b8f2472d8bf284d6f7237a35794bdb444bd150b9a4f408e1b10333
SHA1 hash: f012c38deed41a0cd93eb5457cfded5b8ce005dd
MD5 hash: 79fe846115c81cb8597a899bd85c87b9
humanhash: quebec-comet-mango-chicken
File name:RFQ CTC Group Global-9463.IMG
Download: download sample
Signature GuLoader
Create hunting rule
File size:131'072 bytes
First seen:2020-06-10 12:35:29 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:nz7OuPI2ZEYzKfUpj1rugSWkOqTGRiRHHP287wKcdv:uZY2fkruPOq6uv287wKcdv
TLSH EDD33B127E94AD72C67546F23FF0925850A7B83205F18407F65C3A1E1B3BD4AFA6A31B
Reporter abuse_ch
Tags:GuLoader img


Avatar
abuse_ch
Malspam distributing GuLoader:

From: Titus S Kemp <procurement officer@ctc-group.com>
Subject: RE: Urgent Request Quotation CTC Group Global For HTR 864
Attachment: RFQ CTC Group Global-9463.IMG (contains "RFQ CTC Group Global-IMG.com")

GuLoader payload URL:
https://onedrive.live.com/download?cid=2E7E4C1987025FEB&resid=2E7E4C1987025FEB%21106&authkey=ACJwSTwomKrUSFo

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Gen.NN.ZevbaF.34128.em0@a4E41PiG.28601.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 12:37:03 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ytkln4pepvtqaiurug6tasitwl7446e5gynnu74qaca63avvkba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

img fe26a5b78f23eb3801148d0de982489d97fe73c4e9b0d6d3fc80040f6c15aa82

(this sample)

GuLoader

Executable exe 7e8e1de7b35bbdd1e9a7aedaa1e3e73602e778768052474e7e56140baaf85e37

  
URLhaus
https://urlhaus.abuse.ch/url/385330/
  
Dropping
MD5 ad5aaff929bfcad033364fa9bb868bc3
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7e8e1de7b35bbdd1e9a7aedaa1e3e73602e778768052474e7e56140baaf85e37

Comments