MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b89ef6de88e2a69a5f1f10d4a1ffcdb5a7562d184ff60162687f0e4d844f75f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	5b89ef6de88e2a69a5f1f10d4a1ffcdb5a7562d184ff60162687f0e4d844f75f
SHA3-384 hash:	066bdb3e7a7f7669f8ca03419e47d07d3ac4d905f22330524f3ef6434d74defbfc8538dd2b07fec12ac9c46b0070ddd3
SHA1 hash:	a6e93c0e8d8f2857c5a5021cf289d49c9b5b76f6
MD5 hash:	2e08c934e492a926b65301259bf60e17
humanhash:	lake-ten-monkey-maine
File name:	CLOSE DOWN ORDER FROM CDC DATED 4.1.2020.bat
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	102'400 bytes
First seen:	2020-04-07 19:29:21 UTC
Last seen:	2020-04-07 20:37:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	2f264feef3f20baf44d399b781e8e5ba (1 x GuLoader)
ssdeep	768:HOfFRevU4zPPcIR2VowKmSlOBMBlSIJuENOsNSHs7h:KH2H8IRY8lOB64uD8sNxd
Threatray	689 similar samples on MalwareBazaar
TLSH	24A3E566BD60FDE1F8140FB06D379EAC01E5AC3499053A47B5C43F6E39325867AA2B06
Reporter	abuse_ch
Tags:	COVID-19 exe GuLoader

abuse_ch

COVID-19 themed malspam:

HELO: 162-241-214-72.unifiedlayer.com
Sending IP: 162.241.214.72
From: HR Department <HR@victim-domain>
Subject: (UPDATE COVID-19) CLOSE DOWN ORDER FROM CDC DATED 4.1.2020
Attachment: CLOSE DOWN ORDER FROM CDC DATED 4.1.2020.arj (contains "CLOSE DOWN ORDER FROM CDC DATED 4.1.2020.bat")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Dropper.Genkryptik-7653837-0

Gathering data

Threat name:

Win32.Trojan.Minix

Status:

Malicious

First seen:

2020-04-07 16:43:17 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

27 of 31 (87.10%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=loe663piryvgtjpr6eguuh743nnhkywrqt7wafrgq7yojwce65pq._file

Verdict:

malicious

Label(s):

guloader

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

arj d0326733a352a5c5b21489ce5b2e21ace51437473b5b2c1504247c7610602f03

GuLoader

exe 5b89ef6de88e2a69a5f1f10d4a1ffcdb5a7562d184ff60162687f0e4d844f75f

(this sample)

AgentTesla

exe 50762c245b64ddede69fe5db39aec6c4c31bbb18520c6696368aa39ddea03006

Dropped by

MD5 d0173ee18ec809226717a22e511a2650

Dropped by

SHA256 d0326733a352a5c5b21489ce5b2e21ace51437473b5b2c1504247c7610602f03

Delivery method

Distributed via e-mail attachment

Dropping

SHA256 50762c245b64ddede69fe5db39aec6c4c31bbb18520c6696368aa39ddea03006

Dropping

MD5 4f334b62a81ad6cc0b5868120a225099

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
VB_API	Legacy Visual Basic API used	MSVBVM60.DLL::__vbaObjSetAddref MSVBVM60.DLL::EVENT_SINK_AddRef MSVBVM60.DLL::__vbaLateMemCallLd

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample