🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bdbcfc9e44e0e6a0ef9956a7f5bed3aacdecabaaa79fbc8bdd7151bd089c205. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 9


Intelligence 9 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2bdbcfc9e44e0e6a0ef9956a7f5bed3aacdecabaaa79fbc8bdd7151bd089c205
SHA3-384 hash: 57fef51aebcf630f7bf34cbaf87a9ecea4ebc73b27418108111386d988be2089fcfea620fa5201f39ffd5817c95a3d4d
SHA1 hash: 77b57e3fd71a50f87b403d60dda5584882244981
MD5 hash: 03edc3aad7dd1c629dd911b7434b963f
humanhash: east-xray-twelve-wyoming
File name:swift.gz
Download: download sample
Signature GuLoader
Create hunting rule
File size:198'248 bytes
First seen:2026-09-18 06:31:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Bs4PM7XlvjmkonHUdKRDYuYSyCFaeeISuO:u4k7JIH2Peaey
TLSH T13A14129113788BD646217C7428E9020F7D1AADB3F34F6E1C8869978B689D1C5B4DF8AC
Magika zip
Reporter Anonymous
Tags:GuLoader remcos zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
DK DK
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Sakse.vbs
File size:387'918 bytes
SHA256 hash: 34390fbe982d7473554cc51c4b5d44f5157f2037cc36631d37a2d00f85b022eb
MD5 hash: 603a487f38b41f5ef4f75617e5d9e4d8
MIME type:text/plain
Signature GuLoader
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/65acc02c-34f7-45a7-ba44-3438f04b3f78/
Detection(s):
Sanesecurity.Foxhole.JS_Zip_1v.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
VBS File - Malicious
Link:
https://app.docguard.net/2bdbcfc9e44e0e6a0ef9956a7f5bed3aacdecabaaa79fbc8bdd7151bd089c205/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd lolbin
Link:
https://www.filescan.io/uploads/6aacdaec956b95c8f7d10418/reports/67d1cc4f-359e-433c-a64d-575b4a32efd6/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/2bdbcfc9e44e0e6a0ef9956a7f5bed3aacdecabaaa79fbc8bdd7151bd089c205
Verdict:
Malicious
File Type:
zip
First seen:
2026-09-17T07:41:00Z UTC
Last seen:
2026-09-18T01:09:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/2bdbcfc9e44e0e6a0ef9956a7f5bed3aacdecabaaa79fbc8bdd7151bd089c205/results?tab=lookup
Score:
99%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/2bdbcfc9e44e0e6a0ef9956a7f5bed3aacdecabaaa79fbc8bdd7151bd089c205
Verdict:
Malware
YARA:
2 match(es)
Tags:
COM Behavior Trace DeObfuscated Obfuscated SOS: 0.31 T1027 T1059.005 VBScript WScript.Shell Zip Archive
Link:
https://app.malva.re/file/03edc3aad7dd1c629dd911b7434b963f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2bdbcfc9e44e0e6a0ef9956a7f5bed3aacdecabaaa79fbc8bdd7151bd089c205/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fpn47spejyhgudxzsvvh6w7nhkwn5sv2vj47xsf524krxuejyicq._file
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost collection discovery execution rat
Link:
https://tria.ge/reports/260918-h5msvszbne/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Enumerates physical storage devices
Executes a command shell one-liner
System Location Discovery: System Language Discovery
Executes a VBScript file via the Windows Script Host.
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Accesses Microsoft Outlook profiles
Contacts third-party web service commonly abused for C2
Checks computer location settings
Badlisted process makes network request
Detected Nirsoft tools
NirSoft MailPassView
NirSoft WebBrowserPassView
Family: Remcos
Malware Config
C2 Extraction:
130.12.182.211:2404
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique
Rule name:Guloader_VBScript
Create hunting rule
Author:Ankit Anubhav - ankitanubhav.info
Description:Detects GuLoader/CloudEye VBScripts
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip 2bdbcfc9e44e0e6a0ef9956a7f5bed3aacdecabaaa79fbc8bdd7151bd089c205

(this sample)

anyrun
any.run
https://app.any.run/tasks/b94c9e01-300c-4eee-b85d-fc619058e5c2/
  
Delivery method
Distributed via e-mail attachment

Comments