MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aab25b636f9de1565af12c7d0468be4dc26ea80c09e130fd9f443d714747b60f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	aab25b636f9de1565af12c7d0468be4dc26ea80c09e130fd9f443d714747b60f
SHA3-384 hash:	5ae88355cbc0f4925f549e29d6da4da9bb693e6883beb33943d20561c119afab05bad87b2ef1898146b05a731f4e5961
SHA1 hash:	787237533806971f5115e9bf1b07201ddae4f641
MD5 hash:	a3f29ece5c676b1a6ea51707a2f4083a
humanhash:	ink-ink-crazy-cup
File name:	Pedido de cotação -Lista de materiais.vbs
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	91'640 bytes
First seen:	2024-01-10 09:46:04 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	1536:J9fGddPhRcbIybBrPu6eXYSXQjbrDqHESoRgsXJkGn6OO7K:rfg5j4IArWVoSAjnGHESoRgUJkg6OO7K
TLSH	T10593F720CAC516390E7E07BAAF014C01F4BB843D4235A8FFE599376E13A295C977B679
Reporter	abuse_ch
Tags:	GuLoader vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

125

Origin country :

NL

Vendor Threat Intelligence

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/aab25b636f9de1565af12c7d0468be4dc26ea80c09e130fd9f443d714747b60f

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox AgentTesla, GuLoader

Result

Threat name:

AgentTesla, GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

spre.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1372302

Signature

Antivirus detection for URL or domain

Found suspicious powershell code related to unpacking or dynamic code loading

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Powershell uses Background Intelligent Transfer Service (BITS)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: MSBuild connects to smtp port

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

VBScript performs obfuscated calls to suspicious functions

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

84%

Verdict:

Malware

File Type:

ASCII

Link:

https://malprob.io/report/aab25b636f9de1565af12c7d0468be4dc26ea80c09e130fd9f443d714747b60f

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aab25b636f9de1565af12c7d0468be4dc26ea80c09e130fd9f443d714747b60f/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vkzfwy3ptxqvmwxrfr6qi2f6jxbg5kambhqtb7m7iq6xcr2hwyhq._file

Threatray unknown

Verdict:

unknown

Hatching Triage guloader

Result

Malware family:

guloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:guloader downloader keylogger spyware stealer trojan

Link:

https://tria.ge/reports/240110-lr7snadadp/

Behaviour

NTFS ADS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Checks computer location settings

AgentTesla

Guloader,Cloudeye

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/aab25b636f9de1565af12c7d0468be4dc26ea80c09e130fd9f443d714747b60f