MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c144435ad3054ae4f0394ef2fd02e9829f9e579077860b3034d9d841e9d79a79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c144435ad3054ae4f0394ef2fd02e9829f9e579077860b3034d9d841e9d79a79
SHA3-384 hash: 5b08da6005ddab85c4e1f4634f18bc1b84ff0bb2651777e399430e38172e0806415a32b273c9ce7e893784ec00d666f1
SHA1 hash: 452e64bb1a0f85c40a38d1729acea6ba15b45b10
MD5 hash: e4feb0d779d5e06c5efcd727668fd665
humanhash: two-triple-aspen-oven
File name:OR08421366869_00010119.vbs
Download: download sample
Signature GuLoader
Create hunting rule
File size:317'636 bytes
First seen:2022-12-05 09:04:05 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 6144:Z1FhQAhIuyGXbVqwtBTiYuyrliO6CvLNLaPyovC9bwEaF6/E:V/hRt8YiV4lXlNL2yovzl
Threatray 3'531 similar samples on MalwareBazaar
TLSH T15D647A508DAD1D6F0E7E2E92F0BB15DCF368CF6613419D9B1964E347890E208EB1B64E
Reporter abuse_ch
Tags:GuLoader vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/342820/
Detection(s):
Sanesecurity.Malware.26618.JsHeur.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/638db440485d8463dc40b191/reports/c7bd04f2-c9ae-43ac-b84e-7bf7dd193dcc/overview
Result
Verdict:
MALICIOUS
Details
Base64 Encoded URL
Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1127846
Signature
Obfuscated command line found
Tries to detect Any.run
VBScript performs obfuscated calls to suspicious functions
Very long command line found
Wscript starts Powershell (via cmd or directly)
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 760568 Sample: OR08421366869_00010119.vbs Startdate: 05/12/2022 Architecture: WINDOWS Score: 72 28 Yara detected GuLoader 2->28 8 wscript.exe 1 1 2->8         started        process3 signatures4 32 VBScript performs obfuscated calls to suspicious functions 8->32 34 Wscript starts Powershell (via cmd or directly) 8->34 36 Obfuscated command line found 8->36 38 Very long command line found 8->38 11 powershell.exe 7 8->11         started        14 cmd.exe 1 8->14         started        process5 signatures6 40 Very long command line found 11->40 16 powershell.exe 11->16         started        18 conhost.exe 11->18         started        20 conhost.exe 14->20         started        process7 process8 22 CasPol.exe 13 16->22         started        dnsIp9 26 drive.google.com 142.250.203.110, 443, 49707, 49708 GOOGLEUS United States 22->26 30 Tries to detect Any.run 22->30 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c144435ad3054ae4f0394ef2fd02e9829f9e579077860b3034d9d841e9d79a79/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-12-05 09:05:07 UTC
File Type:
Text (VBS)
AV detection:
8 of 41 (19.51%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yfcegwwtavfoj4bzj3zp2axjqkpz4v4qo6dawmbu3hmed2oxtj4q._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
13d8b891a0f9c00af8c624a5bfd24f42d15fba3e19225d29b9af39cd9f8cea03
GuLoader
293e46a6a6b995b7a2528d658b56cb957a4a77e011909261bfa6cc5838723b71
GuLoader
2954a47a08fc2a79ab0644550c68c380b67ace8d62c0c58933b756e4a541d91d
GuLoader
3d7d08118935757fe3f528538abde2e16f054264127b6f420c2ee44e6fcff568
GuLoader
7b2bcaa3723a8198c9a6f0878b77c7887554079e77e5c9b8f444570be1d744f6
GuLoader
e5120ba9e08623e6f047e1c50aacc2787631e53d8fd547f5d45cd7af81fd7494
GuLoader
+ 3'521 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/221205-k1nkpshe9y/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Checks QEMU agent file
Checks computer location settings
Blocklisted process makes network request
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c144435ad305/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c144435ad3054ae4f0394ef2fd02e9829f9e579077860b3034d9d841e9d79a79

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:WScript_Shell_PowerShell_Combo_RID32E7
Create hunting rule
Author:Florian Roth
Description:Detects malware from Middle Eastern campaign reported by Talos
Reference:http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/342820/

Comments