MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5111fc70781dae71196f0f661b22448f386c3fc14f902d0aeffb5790ed8c2fb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5111fc70781dae71196f0f661b22448f386c3fc14f902d0aeffb5790ed8c2fb4
SHA3-384 hash:	87980ce448c688ed61b2ec46ce4b581e893ff8b2bbc931e004c22fabab13bd1c02bf767bc0e5965dbe5ea5046cd07bcc
SHA1 hash:	b54b1258b14a3e163ceff7d4a3b5d7fd7705e946
MD5 hash:	d30c0d6ac139abea635d5238c64b7101
humanhash:	lamp-victor-gee-cold
File name:	Order Mr. Pastor.vbs
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	47'413 bytes
First seen:	2023-12-18 18:53:01 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	768:e0h/j5hL6wJgO6NsEVG15rMKbfGVR0AZl74sZr2sAJDxDxnfVMufuI06UL3Ge:e8/j5Im6NsCq/Da94sZrWlDhVMCqzLJ
Threatray	4'018 similar samples on MalwareBazaar
TLSH	T1662329A1CB951919480A277ADC037B80F97D8CD60536E0E9AD9D038E230758C9FBF71B
Reporter	abuse_ch
Tags:	GuLoader vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

115

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/468342/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.25535.29350.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm cmd masquerade powershell

Link:

https://www.filescan.io/uploads/65809512b855eb3693e48ab3/reports/0c06ee3b-a814-4fa1-a7ff-04b73bf2bb28/overview

Hybrid Analysis Trojan.VBS.SAgent

Verdict:

Malicious

Labled as:

Trojan.VBS.SAgent

Link:

https://www.hybrid-analysis.com/sample/5111fc70781dae71196f0f661b22448f386c3fc14f902d0aeffb5790ed8c2fb4

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox AgentTesla, GuLoader

Result

Threat name:

AgentTesla, GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

spre.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1364115

Signature

Antivirus detection for URL or domain

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Powershell uses Background Intelligent Transfer Service (BITS)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: MSBuild connects to smtp port

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

VBScript performs obfuscated calls to suspicious functions

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

ASCII

Link:

https://malprob.io/report/5111fc70781dae71196f0f661b22448f386c3fc14f902d0aeffb5790ed8c2fb4

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5111fc70781dae71196f0f661b22448f386c3fc14f902d0aeffb5790ed8c2fb4/

ReversingLabs TitaniumCloud Win32.Dropper.Generic

Threat name:

Win32.Dropper.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-12-18 18:54:05 UTC

File Type:

Text (VBS)

AV detection:

1 of 37 (2.70%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kei7y4dydwxhcglpb5tbwiser44gyp6bj6ic2cxp7nlzb3mmf62a._file

Threatray agenttesla_v4 agenttesla

Verdict:

malicious

Label(s):

agenttesla_v4

Alert

Create hunting rule

agenttesla

Alert

Create hunting rule

Similar samples:

4ec757a53ab17fbf9fb784f7acbf23a44ce3fcff4ebe00c067ec36bdc6c0e8f3

GuLoader

5c3a1a44e8f69e87acc9b95aa6798fcecbc33dc8f11a96b89bea796236887f92

GuLoader

f24a13886b4f210691bf73566963618b370ca0781cf65cb212cafb13e12060ff

GuLoader

+ 4'008 additional samples on MalwareBazaar

Hatching Triage agenttesla

Result

Malware family:

agenttesla

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/231218-xjl2rsech3/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Legitimate hosting services abused for malware hosting/C2

Checks computer location settings

Blocklisted process makes network request

AgentTesla

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5111fc70781d/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5111fc70781dae71196f0f661b22448f386c3fc14f902d0aeffb5790ed8c2fb4

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

vbs 5111fc70781dae71196f0f661b22448f386c3fc14f902d0aeffb5790ed8c2fb4

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/468342/