MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 166c97af00815207e0a7e31177e1013f50fa7866e11cdc27120db0fbc44a1918. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 9

Intelligence 9 IOCs YARA 13 File information Comments

SHA256 hash:	166c97af00815207e0a7e31177e1013f50fa7866e11cdc27120db0fbc44a1918
SHA3-384 hash:	7b70f3c80ef96963facd40f6337e7b3900bc807932b65f622ad86b9e2ddf785a713c36c77ec47d0812fe2732d8cec7e5
SHA1 hash:	ebe2031158fb82af85f89e6c20496eaa43e8a397
MD5 hash:	7ab8f7cb6fa29f94f14c6ae4e7c30410
humanhash:	music-butter-potato-tennessee
File name:	INVOICE.zip
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	378'599 bytes
First seen:	2025-09-25 13:21:33 UTC
Last seen:	2025-09-25 13:23:02 UTC
File type:	zip
MIME type:	application/zip
ssdeep	6144:+oFLYRMuohwoGYRoWAL7N4nqlq1IhufMpX4pOaz2QBRejo5EItI1wRsE06vOpAyr:/FptRoBL81IwfMpH7QaKf8wG6W+0
TLSH	T1F1842391C49568AB8F083BB4628FD9C815B26D8E0B770FC4E5153805DE838B9F9D2DB7
Magika	zip
Reporter	cocaman
Tags:	GuLoader INVOICE payment zip

cocaman

Malicious email (T1566.001)
From: "sales@singmarmarine.com" (likely spoofed)
Received: "from [213.209.157.41] (unknown [213.209.157.41]) "
Date: "25 Sep 2025 06:21:47 -0700"
Subject: "RE: RECONFIRM BANK DETAILS FOR PAYMENT "
Attachment: "INVOICE.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

125

Origin country :

File Archive Information

This file archive contains 9 file(s), sorted by their relevance:

File name:	indsbningernes.uku
File size:	1'206 bytes
SHA256 hash:	8d8fb4646bf817f89b8b0b92ea22fbea7cde86f3adf0dc1c5b742c2c05a292be
MD5 hash:	4002eb52e2c3524d6fdb0d07bcb6ca12
MIME type:	application/octet-stream
Signature	GuLoader

File name:	System.dll
File size:	12'288 bytes
SHA256 hash:	a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
MD5 hash:	81e268e27dbbcadbf116b5a9402195ab
MIME type:	application/x-dosexec
Signature	GuLoader

File name:	modern-wizard.bmp
File size:	26'494 bytes
SHA256 hash:	3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 hash:	cbe40fd2b1ec96daedc65da172d90022
MIME type:	image/bmp
Signature	GuLoader

File name:	Turniplike28.Ter
File size:	16'600 bytes
SHA256 hash:	bb1b25bb5daf44a25f7a71e52a3040851ec17630ea1854db5bb769622cbaef31
MD5 hash:	57306f0e6ef0fdaa3e43174b3a0b7bb3
MIME type:	application/octet-stream
Signature	GuLoader

File name:	nsDialogs.dll
File size:	9'728 bytes
SHA256 hash:	7853be9190489ba84dae8232e9a967cec02d941732cb4137bc9ae6a392e89fb8
MD5 hash:	3fbd78c889fa40a2e5567b980c57b7db
MIME type:	application/x-dosexec
Signature	GuLoader

File name:	jagerpiloters.une
File size:	265 bytes
SHA256 hash:	f48a4f8924a3401f361a026fb6cc29a0f49390636b8a93ad3e468edcf54268a5
MD5 hash:	a8041bc00bb6c052fdff4904fae8dd8d
MIME type:	application/octet-stream
Signature	GuLoader

File name:	BgImage.dll
File size:	7'680 bytes
SHA256 hash:	68b17d8f988354adecd50d824568029ebd51d88293874ac2178cb49de2d763b7
MD5 hash:	4f2bc691e903d2cb134fb48a622df098
MIME type:	application/x-dosexec
Signature	GuLoader

File name:	Pengevask.Res
File size:	384'336 bytes
SHA256 hash:	8960dcf79d743f9006dba1f4c6378c109b2ee377cd708a509abbf49350d81c61
MD5 hash:	ab8725c5a3e6b157ca41ed7856c36a7e
MIME type:	application/octet-stream
Signature	GuLoader

File name:	BANK DETAILS FOR PAYMENT.bat
File size:	397'924 bytes
SHA256 hash:	13199e42b39e183eea312c99eb0bb2cc697f925945b25a6e6dcc1550d4676a9d
MD5 hash:	437618b22ef7ebb31d7bc51f23913e03
MIME type:	application/x-dosexec
Signature	GuLoader

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.NSIS.Guloader.8363.5085.UNOFFICIAL

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68d552751e4783989051f479

Tags:

injection obfusc blic

Result

Verdict:

Suspicious

File Type:

PE File

Link:

https://app.docguard.net/166c97af00815207e0a7e31177e1013f50fa7866e11cdc27120db0fbc44a1918/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

adaptive-context anti-debug blackhole installer masquerade microsoft_visual_cc nsis overlay

Link:

https://www.filescan.io/uploads/68d54226c564c8e81d07ae61/reports/fcb1f366-775f-4f28-8a6a-d4f50996f14a/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/166c97af00815207e0a7e31177e1013f50fa7866e11cdc27120db0fbc44a1918

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/166c97af00815207e0a7e31177e1013f50fa7866e11cdc27120db0fbc44a1918

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

File Type:

zip

First seen:

2025-09-25T08:41:00Z UTC

Last seen:

2025-09-25T08:41:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/166c97af00815207e0a7e31177e1013f50fa7866e11cdc27120db0fbc44a1918/results?tab=lookup

Score:

97%

Verdict:

Malware

File Type:

Result

Malware family:

guloader

Score:

10/10

Tags:

family:guloader discovery downloader installer

Link:

https://tria.ge/reports/250925-qml3lsal3y/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Loads dropped DLL

Guloader family

Guloader,Cloudeye

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/166c97af00815207e0a7e31177e1013f50fa7866e11cdc27120db0fbc44a1918

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	Ins_NSIS_Buer_Nov_2020_1 Create hunting rule
Author:	Arkbird_SOLG
Description:	Detect NSIS installer used for Buer loader

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)