MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0daa29b9c74872bfe69ee54537140e75c43b9227c45d6d202df200d6f3ebeccd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	0daa29b9c74872bfe69ee54537140e75c43b9227c45d6d202df200d6f3ebeccd
SHA3-384 hash:	12acbff77eab7f2342b348647dd1838cccdf981f70b73282f83e9b39a71f99a197f017f3db319271404b887f510055ac
SHA1 hash:	77ececce3bd865a92b317f804b844680d454a32c
MD5 hash:	553e17fc7bece1ed7b9c58d5b3fad671
humanhash:	lake-magnesium-north-december
File name:	LETTER OF INDEMNITY WITHOUT ORIGINAL BL COPY.bat
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	102'400 bytes
First seen:	2020-04-07 19:38:56 UTC
Last seen:	2020-04-08 04:21:24 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	d6036cd970f8ecd5ee767fd0ae8e48d1 (1 x GuLoader)
ssdeep	768:kh5QcvSByf2/cWlZCBaZW3IeCKRq0ZgWkunnm:wQcSBySSaECuq0ZhZ
Threatray	139 similar samples on MalwareBazaar
TLSH	80A3C321BA60FEE1F4104FB25A3A9FAC07E9FC349D522A47A6C53B6D3C750817691B07
Reporter	abuse_ch
Tags:	COVID-19 exe GuLoader

abuse_ch

COVID-19 themed malspam:

HELO: oslindia.com
Sending IP: 23.106.223.9
From: IMPORTS /OSLINDIA <imports@oslindia.com>
Subject: Re: Release of Import DO in present conditions - COVID-19
Attachment: LETTER OF INDEMNITY WITHOUT ORIGINAL BL COPY.arj (contains "LETTER OF INDEMNITY WITHOUT ORIGINAL BL COPY.bat")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Dropper.LokiBot-7668104-0

Gathering data

Threat name:

Win32.Trojan.Agensla

Status:

Malicious

First seen:

2020-04-08 03:58:47 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 31 (83.87%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bwvctoohjbzl7zu64vctofaooxcdxerhyrow2ibn6iann47l5tgq._file

Verdict:

malicious

Label(s):

guloader

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

arj cb6ad7c370e35d73f533e06f833270f183bc1c058d19c15e42d51601a7d94010

GuLoader

exe 0daa29b9c74872bfe69ee54537140e75c43b9227c45d6d202df200d6f3ebeccd

(this sample)

AgentTesla

exe 5a7019b306bf4279968ec47d5a339d654508a8547030b616befefc5bc75df992

Dropped by

MD5 2d684dc608c5b66876b5debbf7b0557b

Dropped by

SHA256 cb6ad7c370e35d73f533e06f833270f183bc1c058d19c15e42d51601a7d94010

Delivery method

Distributed via e-mail attachment

Dropping

SHA256 5a7019b306bf4279968ec47d5a339d654508a8547030b616befefc5bc75df992

Dropping

MD5 b96f3086e301fe682f39ae181994212c

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
VB_API	Legacy Visual Basic API used	MSVBVM60.DLL::__vbaObjSetAddref MSVBVM60.DLL::EVENT_SINK_AddRef MSVBVM60.DLL::__vbaLateMemCallLd

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample