MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 977965787ace76ed2ef7b9d8923958c46ceaefa46ec09ad2436f4b22b1b42513. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	977965787ace76ed2ef7b9d8923958c46ceaefa46ec09ad2436f4b22b1b42513
SHA3-384 hash:	c5821ab7ed2d7ca7c74200087d4c25c86dd55d39b531261150651bcc7b840c8eca9ab05a85c1f1e6560cce1d1777c851
SHA1 hash:	131ffe41766faa1d9f7e54838f3419cd08480c1f
MD5 hash:	a22712d23b2775c205038a1ac865442a
humanhash:	tennis-mobile-comet-lamp
File name:	FACTURAS PENDIENTES.vbs
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	38'593 bytes
First seen:	2024-03-27 06:58:10 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	768:u0bgBGhARWAZGc8NnKwiQREsqf+KhjMFpd:AMAjqNnKw5UnJMFv
Threatray	174 similar samples on MalwareBazaar
TLSH	T1EC030BD2D9892BD44A469BF3DC223B334DB4484977330A7A97BBC24D60439588DBFAC5
Reporter	abuse_ch
Tags:	GuLoader vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

112

Origin country :

NL

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade powershell

Link:

https://www.filescan.io/uploads/6603c3bf749593bccd26d747/reports/a58f78ed-b545-40e0-b1d8-f0cb19ab2681/overview

Hybrid Analysis TrojanDownloader/VBS.Agent

Verdict:

Malicious

Labled as:

TrojanDownloader/VBS.Agent

Link:

https://www.hybrid-analysis.com/sample/977965787ace76ed2ef7b9d8923958c46ceaefa46ec09ad2436f4b22b1b42513

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox AgentTesla, GuLoader

Result

Threat name:

AgentTesla, GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1416261

Signature

Antivirus detection for URL or domain

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Found suspicious powershell code related to unpacking or dynamic code loading

Hides threads from debuggers

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Obfuscated command line found

Powershell uses Background Intelligent Transfer Service (BITS)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

VBScript performs obfuscated calls to suspicious functions

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AgentTesla

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

75%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/977965787ace76ed2ef7b9d8923958c46ceaefa46ec09ad2436f4b22b1b42513

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/977965787ace76ed2ef7b9d8923958c46ceaefa46ec09ad2436f4b22b1b42513/

ReversingLabs TitaniumCloud Script-WScript.Trojan.GuLoader

Threat name:

Script-WScript.Trojan.GuLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-03-26 13:21:40 UTC

File Type:

Text (VBS)

AV detection:

7 of 22 (31.82%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s54wk6d2zz3o2lxxxhmjeokyyrwov35en3ajvusdn5fsfmnueujq._file

Threatray cloudeye

Verdict:

malicious

Label(s):

cloudeye

Alert

Create hunting rule

Similar samples:

086fd488622c16461d2c60ca3cd42a7d5147978f1624e51a04c7ceedcaa71c6c

GuLoader

20c6326c049e6fb205a5feb6266b8ed8061a31fd770dc7771c61995bd701fe7b

GuLoader

3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34

GuLoader

4c97b96baa6e3c1ef907482abe84083c8813d45545d138ec5b9cc456f0027e1b

GuLoader

6206e88335305e4230178b9e72d7c0619cdddf1d470fad04d7a5af3cc3e76dbd

GuLoader

a769d62738c3135274416dec8a9ae7cdf15291a20bb1a20486490eb859ea6936

GuLoader

b67c5941b8a82c44ee8c876e53fc0435d8d5653491b6c61ef0ec5ee92bbfbed0

GuLoader

e0516ae8e938052542c7e7a89713f02c0acf64a7ae9fe210ddbcd618d995e70b

GuLoader

f27ddc5f225f50a392bfcf9cbd59557d445f5ad47f1ad31f1a899aec1ec92611

GuLoader

f29f7cf714a8eef6c8509ea9fc3d6adbedf98e14b0f142bd8bec1fb7de78639b

GuLoader

+ 164 additional samples on MalwareBazaar

Hatching Triage guloader

Result

Malware family:

guloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:guloader downloader keylogger spyware stealer trojan

Link:

https://tria.ge/reports/240327-hr38paaa3y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Checks computer location settings

AgentTesla

Guloader,Cloudeye

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/977965787ace76ed2ef7b9d8923958c46ceaefa46ec09ad2436f4b22b1b42513