🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1baa435dd0c1834273117c8fbbf47cbdfba5450ee71c90926affe63f07afbb92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 18


Intelligence 18 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1baa435dd0c1834273117c8fbbf47cbdfba5450ee71c90926affe63f07afbb92
SHA3-384 hash: 3871e1bf2ac313b1a3972d7459155f9c7fecee2265fc24fdfa36f2b355646e8f936c2dd2e2b6191afe5f70734a4e846f
SHA1 hash: 70b7a1c068e5b96b303a03f29edb094f6bc5b478
MD5 hash: a8eeb48d760948e5e8099bdc13006b70
humanhash: magazine-carbon-vermont-sodium
File name:Oplysningskontors.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:650'503 bytes
First seen:2026-03-27 07:59:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6e7f9a29f2c85394521a08b9f31f6275 (326 x GuLoader, 65 x AgentTesla, 63 x RemcosRAT)
ssdeep 12288:gMwzdCO5/bAH4mWDguDwv4uszqaf8BJsaw3bMg6gK0E9:gMwZCOZsYbDguD3qJB0bMgkR9
Threatray 2'445 similar samples on MalwareBazaar
TLSH T129D412413ECBEDBAF16158310CE9D95676BABC265EA01A4B73413B3F39316168B0F712
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter lowmal3
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
186
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
GuLoader NSIS
Details
GuLoader
an XOR decryption key and an extracted component
GuLoader
a c2 URL, a useragent string, and a string XOR key
NSIS
extracted archive contents
Link:
https://research.acce.ciphertechsolutions.com/results/0331cb3c-5069-4d2f-8bf6-d90b9c66fea0/
Malware family:
remcos
Create hunting rule
ID:
1
File name:
Oplysningskontors.exe
Verdict:
Malicious activity
Analysis date:
2026-03-27 08:00:55 UTC
Tags:
rat remcos auto-reg remote stealer mpress
Link:
https://app.any.run/tasks/7bce5e71-2e71-4e3d-928a-067cfb3aa87a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/59492/
Detection(s):
SecuriteInfo.com.Trojan.Inject6.15694.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69c63922390b996474142abf
Tags:
injection obfusc
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file in the %AppData% subdirectories
Creating a file in the %temp% subdirectories
Unauthorized injection to a recently created process
Restart of the analyzed sample
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole fingerprint installer installer installer-heuristic microsoft_visual_cc nsis soft-404
Link:
https://www.filescan.io/uploads/69c63921e2df9aa488ba5763/reports/b6477f0b-b313-4d97-9daa-42d24e400dd0/overview
Verdict:
Malicious
Labled as:
Agent.LZB.gen
Link:
https://www.hybrid-analysis.com/sample/1baa435dd0c1834273117c8fbbf47cbdfba5450ee71c90926affe63f07afbb92
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-03-27T00:52:00Z UTC
Last seen:
2026-03-29T06:08:00Z UTC
Hits:
~1000
Detections:
Trojan.Win32.Guloader.sb Trojan.NSIS.Makoob.sba Packed.NSIS.Krynis.sb Backdoor.Win32.Remcos.sb Trojan-Dropper.Win32.Injector.sb PDM:Trojan.Win32.Generic HEUR:Trojan-Downloader.Win32.Minix.gen Trojan-Downloader.Win32.Minix.sb
Link:
https://opentip.kaspersky.com/1baa435dd0c1834273117c8fbbf47cbdfba5450ee71c90926affe63f07afbb92/results?tab=lookup
Malware family:
Unlabeled
Create hunting rule
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/37852d64-e5d0-4791-8357-442d40604ebb
Result
Threat name:
Remcos, GuLoader
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1890030
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Creates autostart registry keys with suspicious names
Detected Remcos RAT
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected GuLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1890030 Sample: Oplysningskontors.exe Startdate: 27/03/2026 Architecture: WINDOWS Score: 100 78 drive.usercontent.google.com 2->78 80 drive.google.com 2->80 88 Suricata IDS alerts for network traffic 2->88 90 Found malware configuration 2->90 92 Antivirus detection for dropped file 2->92 94 7 other signatures 2->94 10 Oplysningskontors.exe 4 27 2->10         started        14 remcos.exe 2->14         started        16 remcos.exe 21 2->16         started        18 remcos.exe 2->18         started        signatures3 process4 file5 70 C:\Users\user\AppData\Local\...\System.dll, PE32 10->70 dropped 120 Tries to detect virtualization through RDTSC time measurements 10->120 122 Unusual module load detection (module proxying) 10->122 124 Switches to a custom stack to bypass stack traces 10->124 20 Oplysningskontors.exe 2 10 10->20         started        25 Oplysningskontors.exe 10->25         started        72 C:\Users\user\AppData\Local\...\System.dll, PE32 14->72 dropped 27 remcos.exe 14->27         started        29 remcos.exe 14->29         started        74 C:\Users\user\AppData\Local\...\System.dll, PE32 16->74 dropped 31 WerFault.exe 23 16->31         started        76 C:\Users\user\AppData\Local\...\System.dll, PE32 18->76 dropped 33 WerFault.exe 18->33         started        signatures6 process7 dnsIp8 82 drive.google.com 142.251.34.142, 443, 49699, 49725 GOOGLEUS United States 20->82 84 drive.usercontent.google.com 192.178.50.65, 443, 49701, 49726 GOOGLEUS United States 20->84 60 C:\ProgramData\Remcos\remcos.exe, PE32 20->60 dropped 62 C:\ProgramData\...\remcos.exe:Zone.Identifier, ASCII 20->62 dropped 112 Creates autostart registry keys with suspicious names 20->112 35 remcos.exe 21 20->35         started        39 Oplysningskontors.exe 20->39         started        86 130.12.182.113, 2404, 49727, 49728 DATAHOPDatahop-SixDegreesGB Canada 27->86 64 C:\Users\user\AppData\Local\Temp\THEA41.tmp, MS-DOS 27->64 dropped 66 C:\Users\user\AppData\Local\Temp\THE9B4.tmp, MS-DOS 27->66 dropped 68 C:\Users\user\AppData\Local\Temp\THE974.tmp, MS-DOS 27->68 dropped 114 Detected Remcos RAT 27->114 116 Writes to foreign memory regions 27->116 118 Maps a DLL or memory area into another process 27->118 41 userinit.exe 27->41         started        43 userinit.exe 27->43         started        45 userinit.exe 27->45         started        47 4 other processes 27->47 file9 signatures10 process11 file12 58 C:\Users\user\AppData\Local\...\System.dll, PE32 35->58 dropped 96 Multi AV Scanner detection for dropped file 35->96 98 Found hidden mapped module (file has been removed from disk) 35->98 100 Tries to detect virtualization through RDTSC time measurements 35->100 102 Switches to a custom stack to bypass stack traces 35->102 49 remcos.exe 21 35->49         started        52 remcos.exe 35->52         started        104 Tries to steal Instant Messenger accounts or passwords 41->104 106 Tries to steal Mail credentials (via file / registry access) 41->106 108 Tries to harvest and steal browser information (history, passwords, etc) 43->108 110 Unusual module load detection (module proxying) 45->110 signatures13 process14 file15 56 C:\Users\user\AppData\Local\...\System.dll, PE32 49->56 dropped 54 WerFault.exe 19 16 49->54         started        process16
Score:
92%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1baa435dd0c1834273117c8fbbf47cbdfba5450ee71c90926affe63f07afbb92
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1baa435dd0c1834273117c8fbbf47cbdfba5450ee71c90926affe63f07afbb92/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/1baa435dd0c1834273117c8fbbf47cbdfba5450ee71c90926affe63f07afbb92
Threat name:
Win32.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-03-27 05:34:56 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dovegxoqygbue4yrpsh3x5d4xx52krio44ojbetk77td6b5pxoja._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
3e5b41e258fb843f6305b8381be4377aeaf6beb83b59c7578dfc226d2bd9a55a
GuLoader
68db7504dc6689ddfa6f5ca341c824f1f34dea654ad653153be12b0dc2c768ab
GuLoader
6c911c6dc571f10ae519bcded475f8b1d6cf24053a06e97a9002e137420b9f6a
GuLoader
7d7fb25981642c7e5b3f9cb50cd158e2cad03d1c5f0cf146150861c6f6ee7893
GuLoader
966fae15977591dcc0cbb59722997dcc6093e56c4de02f5b20644c4dfe05d2ea
GuLoader
96f03e7de39c9da07c8980e751e9bd492672af5e56841f0a80820fe6031bfdab
GuLoader
bfc26ab00d8285f3790019b1a7714f463edada527ba985ca45517ad2d53f298f
GuLoader
c3a6aaba899b23d82c2a243053ddb261d41690d3a3fcd43804c0f5d384c60800
GuLoader
e2eb4e8d10cc9afb0786c5ce189797809037764207ec5ab4c9463688bc7640c0
GuLoader
ec890897b98ab1becd75a33a0fcb434b25498110a60ee6d628832ec0d25430b6
GuLoader
error
GuLoader
+ 2'435 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost collection discovery persistence rat
Link:
https://tria.ge/reports/260327-jv9ejsgy71/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Adds Run key to start application
Checks installed software on the system
Contacts third-party web service commonly abused for C2
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Detected Nirsoft tools
Remcos
Remcos family
Malware Config
C2 Extraction:
130.12.182.113:2404
Unpacked files
SH256 hash:
1baa435dd0c1834273117c8fbbf47cbdfba5450ee71c90926affe63f07afbb92
MD5 hash:
a8eeb48d760948e5e8099bdc13006b70
SHA1 hash:
70b7a1c068e5b96b303a03f29edb094f6bc5b478
Link:
https://www.unpac.me/results/97538d9b-4600-4692-98a0-cd95220a02f6/
SH256 hash:
acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
MD5 hash:
6e55a6e7c3fdbd244042eb15cb1ec739
SHA1 hash:
070ea80e2192abc42f358d47b276990b5fa285a9
Link:
https://www.unpac.me/results/97538d9b-4600-4692-98a0-cd95220a02f6/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1baa435dd0c1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.79
Link:
https://yomi.yoroi.company/submissions/1baa435dd0c1834273117c8fbbf47cbdfba5450ee71c90926affe63f07afbb92

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 1baa435dd0c1834273117c8fbbf47cbdfba5450ee71c90926affe63f07afbb92

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/59492/

Comments