MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 291fd769c8833b44b7ddb108ff447953d38bc188e8830aa5dafab3a5d49d3431. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 15

Intelligence 15 IOCs YARA 3 File information Comments

SHA256 hash:	291fd769c8833b44b7ddb108ff447953d38bc188e8830aa5dafab3a5d49d3431
SHA3-384 hash:	632c59211203ef25f916bd47619bea4124a8b15a003e936d530468b04e5b43e3eef571756543036017af0618c074d3e1
SHA1 hash:	006e686d101eddc5027e7e79a2a1dbaefc2f4604
MD5 hash:	1b6c6df79e70ff040bae6f73f444dedc
humanhash:	romeo-fanta-stream-lion
File name:	Angrebsmetoders.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	400'136 bytes
First seen:	2026-05-20 17:01:42 UTC
Last seen:	2026-05-20 17:28:37 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e2a592076b17ef8bfb48b7e03965a3fc (419 x GuLoader, 63 x RemcosRAT, 52 x AgentTesla)
ssdeep	6144:t4t6Ls84Wwhvn3yRH1YnCdIkbuTBnNiGDdp5j87LcO/3u6t:tkRW2n3iHAC3iTiwdp5j87Lui
TLSH	T1118401517340E4ABFA5047364E6BEF6652987E253CA0464773D0BFDC3ABE210B646303
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	f0717175f0f06971 (3 x GuLoader)
Reporter	TomU
Tags:	exe GuLoader signed

Code Signing Certificate

Organisation:	Lnklassers
Issuer:	Lnklassers
Algorithm:	sha256WithRSAEncryption
Valid from:	2025-12-14T03:28:17Z
Valid to:	2026-12-14T03:28:17Z
Serial number:	014bbae6a13f43520ebe3f14bc8d480b03771f0f
Thumbprint Algorithm:	SHA256
Thumbprint:	1b4e2a84fbbae8bcaa965848dceb43eb7f09ffe131bf86ad9e902b3fdcc4620c
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/15990632-404f-4d24-ae2e-d2cbd50e2746/

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-05-20 20:24:54 UTC

Tags:

ip-check evasion snake keylogger telegram spyware stealer

Link:

https://app.any.run/tasks/8dfa94b8-b354-4dfb-b37e-fd6e9915e32b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Guloader

Link:

https://www.capesandbox.com/analysis/66753/

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a0decf44159ce11f601cc75

Tags:

injection virus blic

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Searching for the window

Creating a file in the %temp% subdirectories

Delayed reading of the file

Sending a custom TCP request

Unauthorized injection to a recently created process

Restart of the analyzed sample

DNS request

Connection attempt

Sending an HTTP GET request

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug installer installer installer-heuristic microsoft_visual_cc nsis reconnaissance signed smb

Link:

https://www.filescan.io/uploads/6a0deba1861ee596e6419e1f/reports/506f5042-fa53-48d8-8311-3d7afcdb1ef0/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/291fd769c8833b44b7ddb108ff447953d38bc188e8830aa5dafab3a5d49d3431

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-12-18T07:16:00Z UTC

Last seen:

2026-03-28T21:49:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/291fd769c8833b44b7ddb108ff447953d38bc188e8830aa5dafab3a5d49d3431/results?tab=lookup

Malware family:

NSIS

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/57a9a125-2301-4732-9b46-294120e07ce0

Score:

95%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/291fd769c8833b44b7ddb108ff447953d38bc188e8830aa5dafab3a5d49d3431

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/291fd769c8833b44b7ddb108ff447953d38bc188e8830aa5dafab3a5d49d3431/

Threat name:

Win32.Trojan.GuLoader

Status:

Malicious

First seen:

2025-12-18 10:21:39 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 36 (72.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fep5o2oiqm5ujn65weep6rdzkpjyxqmi5cbqvjo27kz2lve5gqyq._file

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:vipkeylogger collection discovery keylogger spyware stealer

Link:

https://tria.ge/reports/260520-vkg34aev8k/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Family: VIPKeylogger

Unpacked files

SH256 hash:

291fd769c8833b44b7ddb108ff447953d38bc188e8830aa5dafab3a5d49d3431

MD5 hash:

1b6c6df79e70ff040bae6f73f444dedc

SHA1 hash:

006e686d101eddc5027e7e79a2a1dbaefc2f4604

Link:

https://www.unpac.me/results/2c0bcce6-59cd-47ed-95d4-dcd693c3d05a/

SH256 hash:

bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

MD5 hash:

17ed1c86bd67e78ade4712be48a7d2bd

SHA1 hash:

1cc9fe86d6d6030b4dae45ecddce5907991c01a0

Link:

https://www.unpac.me/results/2c0bcce6-59cd-47ed-95d4-dcd693c3d05a/

Malware family:

VIPKeylogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/291fd769c883/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.52

Link:

https://yomi.yoroi.company/submissions/291fd769c8833b44b7ddb108ff447953d38bc188e8830aa5dafab3a5d49d3431

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_NSIS_Nullsoft_Installer Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects NSIS installers by .ndata section + NSIS header string

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

exe 291fd769c8833b44b7ddb108ff447953d38bc188e8830aa5dafab3a5d49d3431

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/66753/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample