MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c31703fe238a825c2f0edabb1cf130de04f78702c81608f0fa9cc2267e8b44a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c31703fe238a825c2f0edabb1cf130de04f78702c81608f0fa9cc2267e8b44a8
SHA3-384 hash: 6abe920eaf5c1fc7027101d46805aeebb859a0a79da8b9be22e9924b13ea2fe40448495c995dfdb940885c0ddc88beff
SHA1 hash: 7be322a6b0571912ded2402cd3ac0b2312fb9c1c
MD5 hash: a4163c297e14cd940d72f601f04cabbc
humanhash: hot-fifteen-friend-nine
File name:Richiesta di numero di fattura.vbs
Download: download sample
Signature GuLoader
Create hunting rule
File size:25'984 bytes
First seen:2024-07-11 08:12:40 UTC
Last seen:2024-07-12 05:20:50 UTC
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 384:IZ7eByH2B2qikS088/Iv+T69OlCHEle5Wmja9pR8njiG:GeByHJr2Iq/GWGn9
TLSH T118C2D8D199852FE83A1A0BB6DC17D3325EF5205EB73B4D305B3CB91878026646EBE2C5
Reporter vm001cn
Tags:GuLoader teleservice-hifi-it vbs

Intelligence

File Origin
# of uploads :
2
# of downloads :
139
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Script.SNH-gen.13034.9485.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=668f940f50cbfd4734a8a5a9win7simulatehigh_evasion
Tags:
Banker Encryption Execution Network Talu Dexter
Verdict:
Malicious
Labled as:
Trojan_VBS_GuLoader_NNA_MTB
Link:
https://www.hybrid-analysis.com/sample/c31703fe238a825c2f0edabb1cf130de04f78702c81608f0fa9cc2267e8b44a8
Result
Verdict:
MALICIOUS
Result
Threat name:
GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1471351
Signature
AI detected suspicious sample
Found suspicious powershell code related to unpacking or dynamic code loading
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Obfuscated command line found
Potential evasive VBS script found (sleep loop)
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Uses ping.exe to check the status of other devices and networks
VBScript performs obfuscated calls to suspicious functions
Very long command line found
Wscript starts Powershell (via cmd or directly)
Yara detected GuLoader
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1471351 Sample: Richiesta di numero di fatt... Startdate: 11/07/2024 Architecture: WINDOWS Score: 100 31 6777.6777.6777.677e 2->31 33 teleservice-hifi.it 2->33 39 Malicious sample detected (through community Yara rule) 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected GuLoader 2->43 45 4 other signatures 2->45 9 wscript.exe 1 2->9         started        signatures3 process4 signatures5 47 VBScript performs obfuscated calls to suspicious functions 9->47 49 Suspicious powershell command line found 9->49 51 Wscript starts Powershell (via cmd or directly) 9->51 53 3 other signatures 9->53 12 powershell.exe 14 19 9->12         started        16 cmd.exe 1 9->16         started        process6 dnsIp7 35 teleservice-hifi.it 135.125.4.166, 443, 49705 AVAYAUS United States 12->35 55 Suspicious powershell command line found 12->55 57 Obfuscated command line found 12->57 59 Very long command line found 12->59 61 Found suspicious powershell code related to unpacking or dynamic code loading 12->61 18 powershell.exe 17 12->18         started        21 conhost.exe 12->21         started        23 cmd.exe 1 12->23         started        63 Uses ping.exe to check the status of other devices and networks 16->63 25 conhost.exe 16->25         started        27 PING.EXE 1 16->27         started        signatures8 process9 signatures10 37 Found suspicious powershell code related to unpacking or dynamic code loading 18->37 29 cmd.exe 1 18->29         started        process11
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/c31703fe238a825c2f0edabb1cf130de04f78702c81608f0fa9cc2267e8b44a8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c31703fe238a825c2f0edabb1cf130de04f78702c81608f0fa9cc2267e8b44a8/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2024-07-10 10:39:04 UTC
File Type:
Text (VBS)
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ymlqh7rdrkbfylyo3k5rz4jq3ycppbyczalar4h2ttbcm7ulisua._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/240711-j4earsxdnn/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Blocklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c31703fe238a825c2f0edabb1cf130de04f78702c81608f0fa9cc2267e8b44a8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments