MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59b83a0e37ac6e046cf013616d51dff99d06d0bbbcc02b585c9cd1d1fa7e952d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	59b83a0e37ac6e046cf013616d51dff99d06d0bbbcc02b585c9cd1d1fa7e952d
SHA3-384 hash:	34f3091ef0328ca754a615f1a837d147162a4faf3cef7d2fbc7bacb7e1aa382e9ecce1f49533caaa483bf13c28630534
SHA1 hash:	0b8b47cb69205a89d6fac5ea156630c7732ca031
MD5 hash:	9c85d725803bf621f8a45680650fd841
humanhash:	ceiling-white-zulu-yankee
File name:	MEDUPV843545_EXINV278.PDF.vbs
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	27'621 bytes
First seen:	2024-03-07 13:52:23 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	768:tIIJFMkYm8rSvWiRTcOuTgyjbpfn9FVItJpT+NYQcOudS0ttNA85WvjFSIgya3IW:KAFMk/8uvWiRgOuTgyjbpfn9FVItJpTD
TLSH	T167C216A89E01215A892B26F7E48ECAB5D82950FB5D2154363D0CF53E1C673887F2DC8F
Reporter	malwarelabnet
Tags:	AZORult GuLoader vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

139

Origin country :

CA

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.DownLoader.3067.5590.22682.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/65e9c6c2c1137bbf1493a5bc/reports/49eb4414-4ef6-4ef7-9189-4fd4ea2502d2/overview

Hybrid Analysis VBS/Agent.QMG trojan

Verdict:

Malicious

Labled as:

VBS/Agent.QMG trojan

Link:

https://www.hybrid-analysis.com/sample/59b83a0e37ac6e046cf013616d51dff99d06d0bbbcc02b585c9cd1d1fa7e952d

Joe Sandbox Azorult, GuLoader

Result

Threat name:

Azorult, GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

phis.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1404753

Signature

Antivirus detection for URL or domain

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Powershell uses Background Intelligent Transfer Service (BITS)

Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes

Sigma detected: WScript or CScript Dropper

Snort IDS alert for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

VBScript performs obfuscated calls to suspicious functions

Very long command line found

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Azorult

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

89%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/59b83a0e37ac6e046cf013616d51dff99d06d0bbbcc02b585c9cd1d1fa7e952d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/59b83a0e37ac6e046cf013616d51dff99d06d0bbbcc02b585c9cd1d1fa7e952d/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Guloader

Threat name:

Script-WScript.Trojan.Guloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-03-06 03:46:58 UTC

File Type:

Text (VBS)

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lg4dudrxvrxai3hqcnqw2uo77goqnuf3xtacwwc4tti5d6t6suwq._file

Hatching Triage guloader

Result

Malware family:

guloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:azorult family:guloader collection downloader infostealer spyware stealer trojan

Link:

https://tria.ge/reports/240307-q6ywhsdg2z/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Program crash

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Checks computer location settings

Loads dropped DLL

Reads local data of messenger clients

Blocklisted process makes network request

Azorult

Guloader,Cloudeye

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/59b83a0e37ac6e046cf013616d51dff99d06d0bbbcc02b585c9cd1d1fa7e952d