MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce71b196e2d2e471973112e9ed9b9765927419eb31eb582786e0d022cd14af62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ce71b196e2d2e471973112e9ed9b9765927419eb31eb582786e0d022cd14af62
SHA3-384 hash:	85544305397fd655a09efb412a7028025c118d9704f2723a246bf5329b0ab53edfe3119f35f5428a7d0598825f6df268
SHA1 hash:	37466c9e52be071a2b9bb4606f358a7cbb05d0dc
MD5 hash:	a485f9c22bb28feb62d01c63e1cd9faa
humanhash:	eleven-tango-pluto-magnesium
File name:	IEexplore.hta
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	204'229 bytes
First seen:	2024-08-09 17:31:00 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	768:tZ6A3yXNA0AGAuKMPjeSssA00SrsxDunbQiXAZO:tpsT
TLSH	T10E145957D203F579DB5348FBEA7CAF9113D09E8ACE8C964F40AE44599BD0ADB720C086
Reporter	NDA0E
Tags:	GuLoader hta RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

128

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Obfus-360.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.JS.Obfus-95.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66b65257b35234d5cc65c347

Tags:

Execution Exploit Generic Network Stealth Trojan

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/ce71b196e2d2e471973112e9ed9b9765927419eb31eb582786e0d022cd14af62/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/66b6525ae565ee98cf3e1670/reports/3a62d31d-e132-47dd-a0ea-7afca5a00dda/overview

Hybrid Analysis VBS.Asthma.2.CAAE91FA

Verdict:

Malicious

Labled as:

VBS.Asthma.2.CAAE91FA

Link:

https://www.hybrid-analysis.com/sample/ce71b196e2d2e471973112e9ed9b9765927419eb31eb582786e0d022cd14af62

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Joe Sandbox Cobalt Strike, GuLoader

Result

Threat name:

Cobalt Strike, GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

phis.troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1490759

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

Detected Cobalt Strike Beacon

Found suspicious powershell code related to unpacking or dynamic code loading

Hides threads from debuggers

Loading BitLocker PowerShell Module

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PowerShell case anomaly found

Powershell drops PE file

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes

Suspicious command line found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Writes to foreign memory regions

Yara detected GuLoader

Yara detected obfuscated html page

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ce71b196e2d2e471973112e9ed9b9765927419eb31eb582786e0d022cd14af62

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ce71b196e2d2e471973112e9ed9b9765927419eb31eb582786e0d022cd14af62/

ReversingLabs TitaniumCloud Document-HTML.Trojan.SnakeKeylogger

Threat name:

Document-HTML.Trojan.SnakeKeylogger

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-08-09 06:20:37 UTC

File Type:

Text (JavaScript)

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zzy3dfxc2lshdfzrclu63g4xmwjhigplghvvqj4g4dicftiuv5ra._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

defense_evasion discovery execution persistence

Link:

https://tria.ge/reports/240809-v3pkwstbnj/

Behaviour

Modifies Internet Explorer settings

Modifies registry key

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

NSIS installer

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Evasion via Device Credential Deployment

VMRay GuLoader

Malware family:

GuLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ce71b196e2d2/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI GuLoader

Threat name:

GuLoader

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/ce71b196e2d2e471973112e9ed9b9765927419eb31eb582786e0d022cd14af62