MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 045b514767dbbe5c411284ea83b2d47b62b1f7a258f866871bfebc14667ef5e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 045b514767dbbe5c411284ea83b2d47b62b1f7a258f866871bfebc14667ef5e6
SHA3-384 hash: 50d45361c9299712c017ddf11e32af5dab5e71ce2535af15e554d36b28d4e10b91f77db8da0f8610a1492610bfcfd373
SHA1 hash: 072794bc896461701c0e6308f2237bdf68dcde3c
MD5 hash: 6eb8deaa26a92324954247df08362e27
humanhash: blossom-oklahoma-sink-fish
File name:MT103.vbs
Download: download sample
Signature GuLoader
Create hunting rule
File size:61'946 bytes
First seen:2023-10-20 11:33:12 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 1536:hUTyn3KNa2JV7cNMAPjQN/xgXolDAGPmqSAPl:hUTY3KNHV7SMAPjGyXolD3PRN9
Threatray 3'187 similar samples on MalwareBazaar
TLSH T17B537DF1DF45150A4D4B27EAEC4188B1C57C817A5922053AFFDD238E920BA9C97BEB0D
Reporter abuse_ch
Tags:GuLoader vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader46.25150.19550.29754.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
cerberus
Link:
https://www.filescan.io/uploads/653265adba877ae55911f1bd/reports/9c39ce37-3ca5-4edf-b349-cfc678780643/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/045b514767dbbe5c411284ea83b2d47b62b1f7a258f866871bfebc14667ef5e6
Result
Verdict:
MALICIOUS
Result
Threat name:
GuLoader, Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1329236
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Suspicious powershell command line found
VBScript performs obfuscated calls to suspicious functions
Very long command line found
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected GuLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1329236 Sample: MT103.vbs Startdate: 20/10/2023 Architecture: WINDOWS Score: 100 25 googlehosted.l.googleusercontent.com 2->25 27 drive.google.com 2->27 29 doc-00-10-docs.googleusercontent.com 2->29 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 Antivirus detection for URL or domain 2->45 47 4 other signatures 2->47 9 wscript.exe 1 2->9         started        12 wab.exe 3 1 2->12         started        signatures3 process4 signatures5 49 VBScript performs obfuscated calls to suspicious functions 9->49 51 Suspicious powershell command line found 9->51 53 Wscript starts Powershell (via cmd or directly) 9->53 55 Very long command line found 9->55 14 powershell.exe 16 9->14         started        process6 signatures7 57 Suspicious powershell command line found 14->57 59 Very long command line found 14->59 17 powershell.exe 19 14->17         started        20 conhost.exe 14->20         started        process8 signatures9 35 Writes to foreign memory regions 17->35 37 Maps a DLL or memory area into another process 17->37 39 Found suspicious powershell code related to unpacking or dynamic code loading 17->39 22 wab.exe 3 6 17->22         started        process10 dnsIp11 31 googlehosted.l.googleusercontent.com 142.251.167.132, 443, 49714, 49716 GOOGLEUS United States 22->31 33 drive.google.com 172.253.63.101, 443, 49713, 49715 GOOGLEUS United States 22->33
Score:
100%
Verdict:
Malware
File Type:
ASCII
Link:
https://malprob.io/report/045b514767dbbe5c411284ea83b2d47b62b1f7a258f866871bfebc14667ef5e6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/045b514767dbbe5c411284ea83b2d47b62b1f7a258f866871bfebc14667ef5e6/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-10-18 22:53:39 UTC
File Type:
Text (VBS)
AV detection:
12 of 38 (31.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=arnvcr3h3o7fyqisqtvihmwupnrld55cld4gnby3726bizt66xta._file
Verdict:
malicious
Label(s):
remcos
Create hunting rule
Similar samples:
1eda1b310543e616e8b7b97e8e5f13597fb3a67ed9658b3daba2f49361563689
GuLoader
47e71db77dc8258663e0715a3b8d4a1c9e105f76a0c771d79654fd03236bfd1e
GuLoader
6bb2f555edca2bc8b12c33f65b84d05a570043de008ec8d9a31a6b4952f01d02
GuLoader
84aefd4d28b5549160c5e3f2a0305737cff34147cd1748d366eed38b7db17bb8
GuLoader
8c63c1e28683c7aa90cb40df346fe1d5dbc3b2bd994cd883cd7e551518486098
GuLoader
c2dbf46751c346aa33fe9d846bf934a7f880f37baee41539917e074b15ada779
GuLoader
d1d5c18ceb2963481df617894368f26c879edb5697a6d23fe6fa91e889ce01f6
GuLoader
d42cc862ab4fb764a7a376e528a6373d2f939353d8ea223f2b1e1abd28c5cc84
GuLoader
e05106e87bc020e515701eb173b232dc3faa925ba09948756230b422b814fb08
GuLoader
e278ecca391be13103b9584a01fd2bbd4fabdfef4756e3870e48140a304894e2
GuLoader
+ 3'177 additional samples on MalwareBazaar
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader downloader persistence
Link:
https://tria.ge/reports/231020-npfbqsbh22/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Blocklisted process makes network request
Guloader,Cloudeye
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/045b514767db/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/045b514767dbbe5c411284ea83b2d47b62b1f7a258f866871bfebc14667ef5e6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cerberus
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:Cerberus

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments