MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b048904aa46777bd5ce7c8336c8ffa80f201df52feb289041c11cc052979172. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 14

Intelligence 14 IOCs YARA 2 File information Comments

SHA256 hash:	0b048904aa46777bd5ce7c8336c8ffa80f201df52feb289041c11cc052979172
SHA3-384 hash:	b279582ad3ac61c628be6e7aaafb741c2117c0a92df29a01b295302ab79b7a8f33a2209c20af3aec723fbaac00688879
SHA1 hash:	23c52b07ba61a3e6cec37e1bbf032e23b0d93b61
MD5 hash:	da0a95cfc5cfd3ba396f8b6d8731d49e
humanhash:	illinois-fourteen-robin-lion
File name:	FATURA.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	878'024 bytes
First seen:	2025-11-26 15:14:23 UTC
Last seen:	2025-12-08 15:44:31 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (592 x GuLoader, 130 x RemcosRAT, 84 x EpsilonStealer)
ssdeep	12288:WOJ1hhVuoRDO0pIYv9WzO6H8gvuUh8umxFKNoRwWl8DYs0iZaOCUR9p39xJo5:We3zlIcY9H8BUuuc0NoSWKCiZadedrC5
TLSH	T134152302394384CBD66A0931086D6C653A77BC377AC22B3797DA3B1FA9B9101D73721B
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	lowmal3
Tags:	exe GuLoader signed

Code Signing Certificate

Organisation:	Chloroformist
Issuer:	Chloroformist
Algorithm:	sha256WithRSAEncryption
Valid from:	2025-10-12T09:53:03Z
Valid to:	2026-10-12T09:53:03Z
Serial number:	259aa75175910a75792d2c30631781f6580dc1c9
Thumbprint Algorithm:	SHA256
Thumbprint:	1fb1d9539b2ae1c00402b2249d6418573b399ca2cf660072296e80fd917e260a
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

169

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

FATURA.exe

Verdict:

Malicious activity

Analysis date:

2025-11-26 15:16:21 UTC

Tags:

evasion snake keylogger telegram stealer

Link:

https://app.any.run/tasks/7c4c61de-ce88-4a6c-b614-53dc62dd574d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/41566/

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=692719926cb1dcd577813766

Tags:

shellcode injection obfusc

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Searching for the window

DNS request

Creating a file

Creating a file in the %temp% subdirectories

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug blackhole installer installer installer-heuristic microsoft_visual_cc nsis overlay signed

Link:

https://www.filescan.io/uploads/6927198ff5b8bc6001531bda/reports/12a9094e-e5b9-4458-aa2c-ac581a8507f5/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/0b048904aa46777bd5ce7c8336c8ffa80f201df52feb289041c11cc052979172

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-11-25T08:07:00Z UTC

Last seen:

2025-11-28T13:22:00Z UTC

Hits:

~10000

Detections:

Trojan.Win32.Guloader.sb Trojan.NSIS.Makoob.sbb UDS:DangerousObject.Multi.Generic BSS:Trojan.Win32.Generic Trojan-Downloader.Win32.Minix.sb HEUR:Trojan-Downloader.Win32.Minix.gen

Link:

https://opentip.kaspersky.com/0b048904aa46777bd5ce7c8336c8ffa80f201df52feb289041c11cc052979172/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/eb8e0ae9-14da-431d-9233-3075951be1a9

Result

Threat name:

GuLoader, Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1821227

Signature

AI detected suspicious PE digital signature

Antivirus / Scanner detection for submitted sample

Found malware configuration

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Uses the Telegram API (likely for C&C communication)

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Score:

86%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/0b048904aa46777bd5ce7c8336c8ffa80f201df52feb289041c11cc052979172

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/da0a95cfc5cfd3ba396f8b6d8731d49e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0b048904aa46777bd5ce7c8336c8ffa80f201df52feb289041c11cc052979172/

Verdict:

Malicious

Threat:

Family.SNAKE

Link:

https://tip.neiki.dev/file/0b048904aa46777bd5ce7c8336c8ffa80f201df52feb289041c11cc052979172

Threat name:

Win32.Trojan.Guloader

Status:

Malicious

First seen:

2025-11-25 11:03:32 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 38 (47.37%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bmcisbfkiz3xxvoopsbtnsh7vahsahpvf7vsrecbyeomauuxsfza._file

Verdict:

malicious

Label(s):

cloudeye

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:guloader family:vipkeylogger collection discovery downloader keylogger spyware stealer

Link:

https://tria.ge/reports/251126-sm4nrscl6z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Guloader family

Guloader,Cloudeye

VIPKeylogger

Vipkeylogger family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/38bf44f8-2b5e-43e7-ab0e-bc7298ee45f9

Unpacked files

SH256 hash:

0b048904aa46777bd5ce7c8336c8ffa80f201df52feb289041c11cc052979172

MD5 hash:

da0a95cfc5cfd3ba396f8b6d8731d49e

SHA1 hash:

23c52b07ba61a3e6cec37e1bbf032e23b0d93b61

Link:

https://www.unpac.me/results/5b1bc44d-43be-4411-9036-c44396eb7a8c/

SH256 hash:

a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

MD5 hash:

75ed96254fbf894e42058062b4b4f0d1

SHA1 hash:

996503f1383b49021eb3427bc28d13b5bbd11977

Link:

https://www.unpac.me/results/5b1bc44d-43be-4411-9036-c44396eb7a8c/

Malware family:

GuLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0b048904aa46/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0b048904aa46777bd5ce7c8336c8ffa80f201df52feb289041c11cc052979172

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_NSIS_Nullsoft_Installer Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects NSIS installers by .ndata section + NSIS header string

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

exe 0b048904aa46777bd5ce7c8336c8ffa80f201df52feb289041c11cc052979172

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/41566/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample