MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d206ae7aec2e852e05ca9728c22a17f426984c9dbac09cd61dcd187926bd2236. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	d206ae7aec2e852e05ca9728c22a17f426984c9dbac09cd61dcd187926bd2236
SHA3-384 hash:	0bb4038150e916fde8a871ede66f21e3bdd4db3c94199e2ad52802eba5cb6b7d63fbe31c6ef5d7eead9771ae7610781f
SHA1 hash:	c766d719718f137f38d22c50e9436b0650533ae8
MD5 hash:	ecd0b3e024293b3ef79db465fb08d9bb
humanhash:	jersey-lithium-hotel-emma
File name:	COVID-19 UPDATE MSC AUSTRALIAN BUSINESS CONTINUITY PLAN ANNOUNCEMENT_PDF.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	225'280 bytes
First seen:	2020-04-21 12:22:04 UTC
Last seen:	2020-04-21 12:59:02 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	6d2c6173af6181e31896c6d4ac792ee6 (1 x GuLoader)
ssdeep	1536:Nwu/zJ77nxy7zitxd9R8mBMe+Jt80Lz/IY4qGlBLX58HWW4xgZhjvFSzjMkvil3z:Our9A7aX+mV6i0lwl1i4CfsskuMJi
Threatray	56 similar samples on MalwareBazaar
TLSH	0524F7426D74A967C71846306EE6D7B9C20C3EE0E5D5CA0F60803B1BEF3368665A653F
Reporter	abuse_ch
Tags:	COVID-19 exe GuLoader

abuse_ch

COVID-19 themed malspam distributing GuLoader:

HELO: mail.kawashima.co.id
Sending IP: 180.211.91.26
From: Thomas Wilson MSC <lilik@kawashima.co.id>
Subject: COVID-19 UPDATE // MSC AUSTRALIAN BUSINESS CONTINUITY PLAN\x0a ANNOUNCEMENT
Attachment: COVID-19 UPDATE MSC AUSTRALIAN BUSINESS CONTINUITY PLAN ANNOUNCEMENT_PDF.7z

GuLoader payload URL:
http://www.theelectronics4u.com/og/KELLY%20GIRLS_VvMmz171.bin

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Malware.Generic-7678438-0

Win.Dropper.LokiBot-7678826-0

Win.Dropper.LokiBot-7678947-0

Gathering data

Threat name:

Win32.Trojan.Zbot

Status:

Malicious

First seen:

2020-04-21 01:14:36 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 31 (80.65%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=2idk46xmf2cs4boks4umekqx6qtjqte5xlajzvq5zumhsjv5ei3a._file

Verdict:

malicious

Label(s):

guloader

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

7z 65c66c6b72a13458cab9f352cbf78c6d27377bf7f506ccaa61bbdd4b265a9953

GuLoader

exe d206ae7aec2e852e05ca9728c22a17f426984c9dbac09cd61dcd187926bd2236

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/347545/

Dropped by

MD5 6bb548f52322c411e40030352fd4025b

Dropped by

SHA256 65c66c6b72a13458cab9f352cbf78c6d27377bf7f506ccaa61bbdd4b265a9953

Delivery method

Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
VB_API	Legacy Visual Basic API used	MSVBVM60.DLL::__vbaObjSetAddref MSVBVM60.DLL::EVENT_SINK_AddRef

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample