MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f29f7cf714a8eef6c8509ea9fc3d6adbedf98e14b0f142bd8bec1fb7de78639b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f29f7cf714a8eef6c8509ea9fc3d6adbedf98e14b0f142bd8bec1fb7de78639b
SHA3-384 hash: b856e33e591e89cd65c2dccfcff351e2a34e136c4c1dfeb554fb81092e81b0b83ce8399fe14935f60059a9debb18cb97
SHA1 hash: 7e8771794d9a9a373c80cef7dab3cf844b4840c9
MD5 hash: 5ffbf02fa6d23ffec8631f0f137d9473
humanhash: fanta-three-december-monkey
File name:awb_shipping_documents_20_03_2024_000000000.vbs
Download: download sample
Signature GuLoader
Create hunting rule
File size:17'846 bytes
First seen:2024-03-20 07:11:42 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 384:rh3f7zvIivjPPmV2nZbY9R1fec5d1ZOUjoZGLWpWS:rh3fvvLPfBcz5hOUkZNWS
Threatray 53 similar samples on MalwareBazaar
TLSH T1748239D49E9522E4906322FB846F35BDD02E20F3A9B645792D5CF5308D027E53E9D88F
Reporter abuse_ch
Tags:GuLoader vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Script.SNH-gen.2815.19369.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm masquerade
Link:
https://www.filescan.io/uploads/65fa8c4c87137159d44afc1b/reports/fd004c07-4332-4652-a02b-3b0475b790b9/overview
Verdict:
Suspicious
Labled as:
Trojan.VBS.SAgent
Link:
https://www.hybrid-analysis.com/sample/f29f7cf714a8eef6c8509ea9fc3d6adbedf98e14b0f142bd8bec1fb7de78639b
Result
Verdict:
MALICIOUS
Details
Base64 Encoded URL
Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.
Result
Threat name:
GuLoader, Remcos
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1412182
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Installs a global keyboard hook
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Potential malicious VBS script found (suspicious strings)
Powershell uses Background Intelligent Transfer Service (BITS)
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)
Sample has a suspicious name (potential lure to open the executable)
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes
Sigma detected: WScript or CScript Dropper
Snort IDS alert for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
VBScript performs obfuscated calls to suspicious functions
Very long command line found
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected GuLoader
Yara detected Remcos RAT
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1412182 Sample: awb_shipping_documents_20_0... Startdate: 20/03/2024 Architecture: WINDOWS Score: 100 49 geoplugin.net 2->49 69 Snort IDS alert for network traffic 2->69 71 Multi AV Scanner detection for domain / URL 2->71 73 Found malware configuration 2->73 75 13 other signatures 2->75 11 wscript.exe 1 2->11         started        14 svchost.exe 1 1 2->14         started        signatures3 process4 dnsIp5 83 VBScript performs obfuscated calls to suspicious functions 11->83 85 Suspicious powershell command line found 11->85 87 Wscript starts Powershell (via cmd or directly) 11->87 89 3 other signatures 11->89 17 powershell.exe 18 11->17         started        55 147.78.103.250, 49703, 49712, 80 CMCSUS Germany 14->55 57 127.0.0.1 unknown unknown 14->57 signatures6 process7 signatures8 59 Suspicious powershell command line found 17->59 61 Very long command line found 17->61 20 powershell.exe 23 17->20         started        23 conhost.exe 17->23         started        25 cmd.exe 1 17->25         started        process9 signatures10 77 Writes to foreign memory regions 20->77 79 Powershell uses Background Intelligent Transfer Service (BITS) 20->79 81 Found suspicious powershell code related to unpacking or dynamic code loading 20->81 27 wab.exe 5 15 20->27         started        32 cmd.exe 1 20->32         started        process11 dnsIp12 51 85.209.176.69, 49713, 49714, 57484 ASDETUKhttpwwwheficedcomGB United Kingdom 27->51 53 geoplugin.net 178.237.33.50, 49715, 80 ATOM86-ASATOM86NL Netherlands 27->53 47 C:\Users\user\AppData\Roaming\pavnspt.dat, data 27->47 dropped 91 Maps a DLL or memory area into another process 27->91 93 Installs a global keyboard hook 27->93 34 wab.exe 1 27->34         started        37 wab.exe 1 27->37         started        39 wab.exe 2 27->39         started        41 4 other processes 27->41 file13 signatures14 process15 signatures16 63 Tries to steal Instant Messenger accounts or passwords 34->63 65 Tries to steal Mail credentials (via file / registry access) 34->65 67 Tries to harvest and steal browser information (history, passwords, etc) 37->67 43 conhost.exe 41->43         started        45 reg.exe 1 1 41->45         started        process17
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f29f7cf714a8eef6c8509ea9fc3d6adbedf98e14b0f142bd8bec1fb7de78639b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f29f7cf714a8eef6c8509ea9fc3d6adbedf98e14b0f142bd8bec1fb7de78639b/
Threat name:
Script-WScript.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2024-03-20 07:12:10 UTC
File Type:
Text (VBS)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6kpxz5yuvdxpnscqt2u7yplk3pw7tdquwdyufpml5qp3pxtymonq._file
Verdict:
unknown
Similar samples:
3854783710a249c1b8d553d298623ec63cc957281d703af14cf778bf18c06a34
GuLoader
496278998f3dbc4bd9cc37ee7e9628cc7a8372f55cb65c5f143b6723bec46096
GuLoader
4c97b96baa6e3c1ef907482abe84083c8813d45545d138ec5b9cc456f0027e1b
GuLoader
5fd79e8094fb1ac9dbc167219bc3218cf07a5679edc11f7847c5cd0b2e756309
GuLoader
9845e47adb818b782750715818bf6e47883961eaaf623db8c9554c03d371903c
GuLoader
d68a5d440931df383de62e3436f5f485ecd75b552e8b78065706a8c880828378
GuLoader
dfa384f6136c43639f6c66766ca81c245e65a70fcf92015656b1cd7a579a3647
GuLoader
e0516ae8e938052542c7e7a89713f02c0acf64a7ae9fe210ddbcd618d995e70b
GuLoader
e156c4e8e53c6b93166fea54fb521d9eb8bc74143ad52697a28809f5639205cf
GuLoader
f27ddc5f225f50a392bfcf9cbd59557d445f5ad47f1ad31f1a899aec1ec92611
GuLoader
+ 43 additional samples on MalwareBazaar
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader downloader persistence
Link:
https://tria.ge/reports/240320-h1jkmsca9w/
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Blocklisted process makes network request
Guloader,Cloudeye
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f29f7cf714a8eef6c8509ea9fc3d6adbedf98e14b0f142bd8bec1fb7de78639b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments