user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Trojan:VBS/GuLoader.RBD!MTB
Trojan:VBS/GuLoader.RBD!MTB - Windows Defender threat signature analysis

Trojan:VBS/GuLoader.RBD!MTB - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Trojan:VBS/GuLoader.RBD!MTB
Classification:
Type:Trojan
Platform:VBS
Family:GuLoader
Detection Type:Concrete
Known malware family with identified signatures
Variant:RBD
Specific signature variant within the malware family
Suffix:!MTB
Detected via machine learning and behavioral analysis
Detection Method:Behavioral
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Trojan - Appears legitimate but performs malicious actions for VBScript platform, family GuLoader

Summary:

This detection identifies a VBScript downloader belonging to the GuLoader malware family. GuLoader's primary function is to evade initial security controls to download and execute more dangerous secondary payloads, such as information stealers, ransomware, or remote access trojans. The !MTB suffix signifies that it was identified through machine learning-based behavioral analysis.

Severity:
Medium
VDM Static Detection:
Relevant strings associated with this threat:
 - byretsdommeres.exe (PEHSTR_EXT)
 - kirkegange\baltheus\digression (PEHSTR_EXT)
 - Precosmically\multihead (PEHSTR_EXT)
 - %seacross%\solcreme (PEHSTR_EXT)
 - \nooky\Concolour.ini (PEHSTR_EXT)
 - \spermatia (PEHSTR_EXT)
Known malware which is associated with this threat:
Filename: P123-24-215 rev.03.vbs
2a37fe6d5c63af1e034500ba56ed6ca4426365fdf25d1a9caa525cc7b5b56bf4
18/11/2025
→VirusTotal↓Download Sample
Filename: 1807370821.vbs
8731f4511d814822155a320ad04518faf8ce5fe78ac609e29395b229d9b99856
18/11/2025
→VirusTotal↓Download Sample
Filename: rPOTECNOVA-OLFAR145KVGIS-BAR29-REG_63826.vbs
163222800e8dcf38c0d10b89ba54f3bb566ddc0ea0063020d51b757585b14612
18/11/2025
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate the affected host from the network to prevent further compromise. Use antivirus software to perform a full system scan and remove all detected components. Since GuLoader downloads other malware, investigate for persistence and secondary payloads, change all user credentials, and consider re-imaging the system.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 18/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊