MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe928777b1bf579d6176f66a0b363b1e49716c9934ccd56d9085f1b5c36dfda6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe928777b1bf579d6176f66a0b363b1e49716c9934ccd56d9085f1b5c36dfda6
SHA3-384 hash: 83b2c56f364d475ec7b1640b8bdd4c6ed4f65a317b37791b7ba8d1ee440cb77b1ff5830714466e0745f2ee2bb911f51c
SHA1 hash: 67c631006b10d792a266f7751c4b99396a61b8a6
MD5 hash: b36ec71f3e5eb31336b5168b65058fa8
humanhash: hamper-moon-mississippi-one
File name:RFQ-OM-3994 - Closing Date 15.06.2020 -MEPF-PO-2020-060PDF.z
Download: download sample
Signature GuLoader
Create hunting rule
File size:74'300 bytes
First seen:2020-06-04 06:03:00 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 768:fZsPtdSFvX+jcxkb0LFhZ25AJ4zV2z+JFuQnks+eBo93lcOivS4sza+0+9+VM5Hz:x0ip+gbrrJQVe+J+b3l4oJFeoONUeYDP
TLSH 587302D6F6DB12604CDF0538B34A51CDCB592ADA65DF812D3B379A12561A317DE00E83
Reporter abuse_ch
Tags:GuLoader z


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: dmpublicrelations.co.uk
Sending IP: 192.119.106.133
From: Leons M <admin@dmpublicrelations.co.uk>
Subject: Product Inquiry - 2354 General Trading,. LLC UAE
Attachment: RFQ-OM-3994 - Closing Date 15.06.2020 - MEPF-PO-2020-060PDF.z (contains "RFQ-OM-3994 - Closing Date 15.06.2020 - MEPF-PO-2020-060.exe")

GuLoader payload URL:
http://www.pdslhk.com/file/bin_nFFal39.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 03:57:05 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=72jio55rx5lz2ylw6zvawnr3dzexc3ezgtgnk3mqqxy3lq3n7wta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

z fe928777b1bf579d6176f66a0b363b1e49716c9934ccd56d9085f1b5c36dfda6

(this sample)

GuLoader

Executable exe b05998bc4d111c80719ab38c75918662f8151fd5e5e223cdc90f0d97caad3b6e

  
URLhaus
https://urlhaus.abuse.ch/url/378977/
  
Dropping
MD5 c5722534cf73c965e7abe61dcbee1a08
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b05998bc4d111c80719ab38c75918662f8151fd5e5e223cdc90f0d97caad3b6e

Comments