MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4c2c8f842ce22820f548ebae96def1fff8f86ce6c92adc4ff801d4adf46e1c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e4c2c8f842ce22820f548ebae96def1fff8f86ce6c92adc4ff801d4adf46e1c9
SHA3-384 hash:	7ababa3ceda917afbb104f36c26b58b38b183cdcf2f6953d4f6c2cfbd1653367232006a913d958978e02c2c64de9682a
SHA1 hash:	4dd314e0f738365ef4d49d264c77a9fc4139fda9
MD5 hash:	1b227096ca56b542f74ca82aaed92911
humanhash:	edward-bulldog-pip-network
File name:	k8dt-vs_n203-e1_1_8_csm1050139.vbs
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	437'920 bytes
First seen:	2023-10-11 19:10:55 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	6144:majeo368cuS1Ahp0SOBccbQIV1zG8T2idKi0aU1ijnc20IrdV20MZ/tTt1JFJ:Lewcx1uAzVgSMVia0c1Z
TLSH	T1F5945CB1EF58151A0D4B37EADC414C81C5BDC16A5927006AFEDD17CEA10B59CE3BEB0A
Reporter	abuse_ch
Tags:	GuLoader vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

88

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/453414/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.27966.12921.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Script.SNH-gen.15538.25915.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6526f34ee66ef03f1778fcf9/reports/17fcd4cd-4a24-4e53-9a1a-e2f8a8dc57c4/overview

Hybrid Analysis Trojan.GenericFCA.Agent

Verdict:

Malicious

Labled as:

Trojan.GenericFCA.Agent

Link:

https://www.hybrid-analysis.com/sample/e4c2c8f842ce22820f548ebae96def1fff8f86ce6c92adc4ff801d4adf46e1c9

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Joe Sandbox AgentTesla, GuLoader

Result

Threat name:

AgentTesla, GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1324051

Signature

Found suspicious powershell code related to unpacking or dynamic code loading

Hides that the sample has been downloaded from the Internet (zone.identifier)

Maps a DLL or memory area into another process

Obfuscated command line found

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

VBScript performs obfuscated calls to suspicious functions

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AgentTesla

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e4c2c8f842ce22820f548ebae96def1fff8f86ce6c92adc4ff801d4adf46e1c9/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Heuristic

Threat name:

Script-WScript.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-10-11 02:40:28 UTC

File Type:

Text (VBS)

AV detection:

9 of 38 (23.68%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4tbmr6cczyried2ur25os3ppd77y7bwonsjk3rh7qaouvx2g4heq._file

Threatray malicious

Verdict:

malicious

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

persistence

Link:

https://tria.ge/reports/231011-xvyjyahe86/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Checks computer location settings

Blocklisted process makes network request

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e4c2c8f842ce/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e4c2c8f842ce22820f548ebae96def1fff8f86ce6c92adc4ff801d4adf46e1c9

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

vbs e4c2c8f842ce22820f548ebae96def1fff8f86ce6c92adc4ff801d4adf46e1c9

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/453414/