🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fa44e363cde69cf582d2124aa62c47c291c21a5c4e62c77f8a156346dd1c94e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 7


Intelligence 7 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0fa44e363cde69cf582d2124aa62c47c291c21a5c4e62c77f8a156346dd1c94e
SHA3-384 hash: ac122d655912e312d7bf69d12e9b850891019c41efe5cc1d8fa07a724719b9a518787ad87d1526acfcf2e926449fc60a
SHA1 hash: 27a5c7b69f9d1d8bb712cb59bb58e53d63442dcb
MD5 hash: d10884faa3505763aab4f34ac87cb90d
humanhash: nebraska-ack-six-ack
File name:2025 Annual Leave Compliance Reportpdf.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'071'739 bytes
First seen:2025-09-29 10:19:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:onYpCYwETfO6/+PX/4FopIzfLgJskj9UgsypRWpgFF60rSSO:FA3j6/Q/4FouzfM/t1pmgRrLO
TLSH T156353329902B6057645AA0FFEB25DA4FF1AB1C6D05046D8BAB83C156EB73BCDCC2D740
Magika zip
Reporter cocaman
Tags:GuLoader gz zip


Avatar
cocaman
Malicious email (T1566.001)
From: "HR Department <miya@servicedive.com>" (likely spoofed)
Received: "from quill.servicedive.com (quill.servicedive.com [94.156.175.118]) "
Date: "29 Sep 2025 02:22:10 +0000"
Subject: "Final Annual Leave Compliance for 2025 (Batch 2)"
Attachment: "2025 Annual Leave Compliance Reportpdf.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
122
Origin country :
CH CH
File Archive Information

This file archive contains 9 file(s), sorted by their relevance:

File name:Nonplatitudinously.ene
File size:8'552'380 bytes
SHA256 hash: 2a07ca960cc0b8249096fddb90193b0a3d3068aea42a9882dbf56c45d2507cc4
MD5 hash: d501c1e9f8cd31cf9f9c1b7559296a8f
MIME type:application/octet-stream
Signature GuLoader
File name:cowsharn.kro
File size:579'460 bytes
SHA256 hash: bdc7878b3677402af93863a787aa1175752ba778fb2feb9042cc4e872372b031
MD5 hash: 8f565a7e7f88e08a6ce1419450930aaa
MIME type:application/octet-stream
Signature GuLoader
File name:System.dll
File size:12'288 bytes
SHA256 hash: a4ec98011ef99e595912718c1a1bf1aa67bfc2192575729d42f559d01f67b95c
MD5 hash: d968cb2b98b83c03a9f02dd9b8df97dc
MIME type:application/x-dosexec
Signature GuLoader
File name:scan.bat
File size:1'092'936 bytes
SHA256 hash: 5c1e7e7b83bc21cebd4ce833cac790ddc3c1f5d1c872fd009aed09b541764b91
MD5 hash: c42d45f0556d13e7f0f867cd76b73463
MIME type:application/x-dosexec
Signature GuLoader
File name:bagsvrds.lic
File size:6'858'709 bytes
SHA256 hash: 7f6c9ca9098548b113c4bf5db9ff3822fe1535337da6e2aa50e34d8c6f65a05e
MD5 hash: 72d299dc23963a5e80b58029d750b104
MIME type:application/octet-stream
Signature GuLoader
File name:nsDialogs.dll
File size:9'216 bytes
SHA256 hash: 99c7654e291227686ffd9414bf77dc6c62d2b712f10348fd8a0697cd4940ef75
MD5 hash: 78e5813c5712f365d29f17e4f2aba6bb
MIME type:application/x-dosexec
Signature GuLoader
File name:altogetherness.stn
File size:1'017'533 bytes
SHA256 hash: d8dfaed898940fd93afa25f5559597aad5bdc98a4ed68930266af7bd71f7afa3
MD5 hash: c3452c1f0a653db26108fce347e9d2e9
MIME type:application/octet-stream
Signature GuLoader
File name:Commit.Pen
File size:581'402 bytes
SHA256 hash: d4327d371efebe503cb5a5cbf1c236dff858e8f637d0a186ea0aaa12c09abaf5
MD5 hash: 265326d8296fa3502a154430eed7b42d
MIME type:application/octet-stream
Signature GuLoader
File name:Kasternes.For
File size:162'620 bytes
SHA256 hash: 1fddf22d61fbba88aeecd3ddcfd62e8d47f2fb0be63862d0860f94e126262002
MD5 hash: 1c4ad29467add75e08ea656dd70568c4
MIME type:application/octet-stream
Signature GuLoader
Vendor Threat Intelligence
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68da5d7f40b7da0b4eb8b6a2
Tags:
n/a
Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/0fa44e363cde69cf582d2124aa62c47c291c21a5c4e62c77f8a156346dd1c94e/results/dashboard
Verdict:
Suspicious
Labled as:
Trojan.U.Remcos
Link:
https://www.hybrid-analysis.com/sample/0fa44e363cde69cf582d2124aa62c47c291c21a5c4e62c77f8a156346dd1c94e
Verdict:
Malicious
File Type:
zip
First seen:
2025-09-28T21:55:00Z UTC
Last seen:
2025-09-28T21:55:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/0fa44e363cde69cf582d2124aa62c47c291c21a5c4e62c77f8a156346dd1c94e/results?tab=lookup
Score:
97%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/0fa44e363cde69cf582d2124aa62c47c291c21a5c4e62c77f8a156346dd1c94e
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Zip Archive
Link:
https://app.malva.re/file/d10884faa3505763aab4f34ac87cb90d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0fa44e363cde69cf582d2124aa62c47c291c21a5c4e62c77f8a156346dd1c94e/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2025-09-29 10:19:46 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b6se4nr43zu46wbneeskuywepquryinfyttcy57yufldi3orzfha._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos collection discovery persistence rat
Link:
https://tria.ge/reports/250929-qes6yszmx7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Detected Nirsoft tools
NirSoft MailPassView
NirSoft WebBrowserPassView
Remcos
Remcos family
Malware Config
C2 Extraction:
196.251.117.66:2404
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/0fa44e363cde69cf582d2124aa62c47c291c21a5c4e62c77f8a156346dd1c94e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 0fa44e363cde69cf582d2124aa62c47c291c21a5c4e62c77f8a156346dd1c94e

(this sample)

GuLoader

Executable exe 5c1e7e7b83bc21cebd4ce833cac790ddc3c1f5d1c872fd009aed09b541764b91

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5c1e7e7b83bc21cebd4ce833cac790ddc3c1f5d1c872fd009aed09b541764b91
  
Dropping
MD5 c42d45f0556d13e7f0f867cd76b73463

Comments