MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 280925849cd341c089c250b6609a0cab91026578f98bc2c45cb924dc9c8967a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 280925849cd341c089c250b6609a0cab91026578f98bc2c45cb924dc9c8967a5
SHA3-384 hash: f5a3349b8da902ed4b3b0bd8c0f090b9735c41abe351fe5daf8c772c71111efed15044c72eb3dac3814621a5da0402d2
SHA1 hash: 331b837d008efc12c0702b290c747581583169fd
MD5 hash: 3d283fd545af947a47e6953d6335b98a
humanhash: foxtrot-virginia-wyoming-skylark
File name:Draft_shipping_document.vbs
Download: download sample
Signature GuLoader
Create hunting rule
File size:824'727 bytes
First seen:2022-03-14 10:22:11 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 3072:qjaPBm0mGlq+KTpUGDh06ClP0cqRZO3S2G6BQ0ef7xm:q90K+KTecjv30ef7xm
TLSH T19A052D64A8B5967D9E8760A3BFC36A3940C07107119C4F7283A465361A7BDEF5A330FB
Reporter abuse_ch
Tags:GuLoader vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
222
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/250091/
Detection(s):
Sanesecurity.Malware.25834.JsHeur.UNOFFICIAL
Create hunting rule

Porcupine.Malware.36555.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/622f1792b94fb38cb4798570/reports/b43d7586-a18c-4db3-8524-d8382eaa7f49/overview
Result
Verdict:
UNKNOWN
Result
Threat name:
FormBook GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/956007
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected FormBook malware
Encrypted powershell cmdline option found
Found malware configuration
Hides threads from debuggers
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Potential malicious VBS script found (has network functionality)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses netsh to modify the Windows network and firewall settings
Very long command line found
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected FormBook
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 588486 Sample: Draft_shipping_document.vbs Startdate: 14/03/2022 Architecture: WINDOWS Score: 100 69 www.usyeslogistics.com 2->69 71 www.tridim.tech 2->71 73 17 other IPs or domains 2->73 81 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->81 83 Found malware configuration 2->83 85 Malicious sample detected (through community Yara rule) 2->85 87 8 other signatures 2->87 12 wscript.exe 2 2->12         started        signatures3 process4 signatures5 105 Wscript starts Powershell (via cmd or directly) 12->105 107 Very long command line found 12->107 109 Encrypted powershell cmdline option found 12->109 15 powershell.exe 24 12->15         started        18 cmd.exe 1 12->18         started        process6 signatures7 111 Tries to detect Any.run 15->111 113 Hides threads from debuggers 15->113 20 ieinstal.exe 6 15->20         started        24 csc.exe 3 15->24         started        27 conhost.exe 15->27         started        29 conhost.exe 18->29         started        31 attrib.exe 1 18->31         started        process8 dnsIp9 75 uruguaynoma.cl 131.72.236.123, 443, 49783 GONZALEZULLOAJUANCARLOSCL Chile 20->75 89 Modifies the context of a thread in another process (thread injection) 20->89 91 Tries to detect Any.run 20->91 93 Maps a DLL or memory area into another process 20->93 95 3 other signatures 20->95 33 explorer.exe 20->33 injected 61 C:\Users\user\AppData\Local\...\zjop44um.dll, PE32 24->61 dropped 37 cvtres.exe 1 24->37         started        file10 signatures11 process12 dnsIp13 63 tridim.tech 156.67.72.97, 49792, 49793, 80 TESONETLT United States 33->63 65 www.dentalbatonrouge.com 108.175.14.116, 49801, 49802, 80 ONEANDONE-ASBrauerstrasse48DE United States 33->65 67 8 other IPs or domains 33->67 77 System process connects to network (likely due to code injection or exploit) 33->77 79 Uses netsh to modify the Windows network and firewall settings 33->79 39 netsh.exe 33->39         started        43 ieinstal.exe 33->43         started        45 ieinstal.exe 33->45         started        signatures14 process15 file16 57 C:\Users\user\AppData\...\9PRlogrv.ini, data 39->57 dropped 59 C:\Users\user\AppData\...\9PRlogri.ini, data 39->59 dropped 97 Detected FormBook malware 39->97 99 Tries to steal Mail credentials (via file / registry access) 39->99 101 Tries to harvest and steal browser information (history, passwords, etc) 39->101 103 4 other signatures 39->103 47 cmd.exe 39->47         started        50 firefox.exe 39->50         started        signatures17 process18 file19 115 Tries to harvest and steal browser information (history, passwords, etc) 47->115 53 conhost.exe 47->53         started        55 C:\Users\user\AppData\...\9PRlogrf.ini, data 50->55 dropped signatures20 process21
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/280925849cd341c089c250b6609a0cab91026578f98bc2c45cb924dc9c8967a5/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=faeslbe42na4bcockc3gbgqmvoiqezly7gf4frc4xesnzhejm6sq._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
cloudeye
Create hunting rule
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader downloader
Link:
https://tria.ge/reports/220314-mevs1aecb8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks QEMU agent file
Checks computer location settings
Guloader,Cloudeye
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/280925849cd3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/280925849cd341c089c250b6609a0cab91026578f98bc2c45cb924dc9c8967a5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Visual Basic Script (vbs) vbs 280925849cd341c089c250b6609a0cab91026578f98bc2c45cb924dc9c8967a5

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/250091/

Comments