MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49b109625db665c82ae907c02b184a90b4388caa1f1ddd2800b944a3bcf9805b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	49b109625db665c82ae907c02b184a90b4388caa1f1ddd2800b944a3bcf9805b
SHA3-384 hash:	d26d024256fec8b9f429e76da3a013521e0a53ea4c252e7348f56c83fc57c550f6d79816c6cbc67ed7977ac98f3153c1
SHA1 hash:	aa9b92b4b2df3c5afbce1516061e458d22f25ead
MD5 hash:	a6a043039b992470c518beb37316b6fb
humanhash:	stream-victor-high-saturn
File name:	Arrival_Notice_Maersk-shipping_83778889__.jpg.vbs
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	31'627 bytes
First seen:	2023-05-22 13:38:02 UTC
Last seen:	2023-05-22 13:49:05 UTC
File type:	vbs
MIME type:	text/plain
ssdeep	768:i8HJvKI41yARlsxM3elBQVgIapmgJeLB/r:i7PPVspmgJ2/r
Threatray	1'560 similar samples on MalwareBazaar
TLSH	T13BE21A71E69D361948CB3BEADC400C60C4BA4D150933156BBE8913AE7787B4C977FA2B
Reporter	abuse_ch
Tags:	GuLoader Maersk vbs

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

139

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.1306.21875.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/646b707794868b4175712a86/reports/5edaf6cd-a2e3-4fb7-89f9-782f686cfdff/overview

Hybrid Analysis Trojan.VBS.SAgent

Verdict:

Suspicious

Labled as:

Trojan.VBS.SAgent

Link:

https://www.hybrid-analysis.com/sample/49b109625db665c82ae907c02b184a90b4388caa1f1ddd2800b944a3bcf9805b

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox FormBook

Result

Threat name:

FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1239732

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected FormBook malware

Found malware configuration

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Sigma detected: Steal Google chrome login data

Tries to detect Any.run

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

VBScript performs obfuscated calls to suspicious functions

Very long command line found

Wscript starts Powershell (via cmd or directly)

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/49b109625db665c82ae907c02b184a90b4388caa1f1ddd2800b944a3bcf9805b/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-05-22 12:58:05 UTC

File Type:

Text (VBS)

AV detection:

2 of 24 (8.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jgyqsys5wzs4qkxja7acwgcksc2drdfkd4o52kaaxfckhphzqbnq._file

Threatray formbook

Verdict:

malicious

Label(s):

formbook

Alert

Create hunting rule

Similar samples:

03a84155093ab32f570220991ff8f30d65fa048544c4e0fd95038c730be6cec4

GuLoader

0b89806418ec582854a24adb93fba607c7f27938f2b653a081aefd1a5e419e4f

GuLoader

229acb9011d2cf600c9112b5f7d19cba56d9bf5ecc20880a6c760e10f685b244

GuLoader

3c7e3789b58b388a933c51740bcdc44c6a46bdaca5969e46b6b183294f470bd3

GuLoader

61141d9453d13d203de8255903f1aec9fea4906616f000cca0b906a58d754cca

GuLoader

6ae1f465cc7f3f76050a4dc053e821ba8b798e323ebf7d8237c9f98b59447061

GuLoader

86d7bb37384646a755a03c2f6e743483ee40d5af6f018824e89c54a9308ceecf

GuLoader

aee5d1b7326545ff692b98743e04d035e01415300fea8a5bf445d3490d6776cc

GuLoader

d167c08baf19919551b1731763974baa43a7193cfaf4704d754308d53bdb2b5e

GuLoader

+ 1'550 additional samples on MalwareBazaar

Hatching Triage guloader

Result

Malware family:

guloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:formbook family:guloader campaign:wt67 downloader persistence rat spyware stealer trojan

Link:

https://tria.ge/reports/230522-qxd5ragg34/

Behaviour

Enumerates system info in registry

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Adds Run key to start application

Checks QEMU agent file

Checks computer location settings

Reads user/profile data of web browsers

Adds policy Run key to start application

Blocklisted process makes network request

Formbook payload

Formbook

Guloader,Cloudeye

VMRay XLoader

Malware family:

XLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/49b109625db6/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/49b109625db665c82ae907c02b184a90b4388caa1f1ddd2800b944a3bcf9805b