🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3267be45cf6025a247c0703b6591ec2e43fa50ea6fbcdab88aaa47c6a140ed46. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3267be45cf6025a247c0703b6591ec2e43fa50ea6fbcdab88aaa47c6a140ed46
SHA3-384 hash: 27fd59c628a8fa72391ee0aac0884172dfaa92c1738c77f69c0853fed8fc796043dcb894af9506bb5c562ed740e670f4
SHA1 hash: 541914d9e93f81b2925b8c62ef24a553b80ce4e3
MD5 hash: db3c44f4d15b7406af8368b5f71f8f0c
humanhash: massachusetts-wyoming-potato-venus
File name:Factura.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:801'704 bytes
First seen:2026-05-20 16:41:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e2a592076b17ef8bfb48b7e03965a3fc (419 x GuLoader, 63 x RemcosRAT, 52 x AgentTesla)
ssdeep 12288:LkIeaGxhD0uhNYH7aXslVZcWpxtXY9n7YAcQixBSeNUea6:zeaGBh4Fan7YnxB6e9
TLSH T1C8059E1FE71089D6D52D8DB4C9B7D3F171B02EE880FA8B8AFD5D9A5A4430B4A323D614
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon cccccccccccccccc (8 x AgentTesla, 4 x Formbook, 2 x CNBackdoor)
Reporter TomU
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:Kravlenisse
Issuer:Kravlenisse
Algorithm:sha256WithRSAEncryption
Valid from:2026-01-25T04:31:58Z
Valid to:2027-01-25T04:31:58Z
Serial number: 0493e522b54d657e80ac4c49913c576351296c91
Thumbprint Algorithm:SHA256
Thumbprint: bdcbca5255924c40c9f501f6b0b3ba83a95f5a26c9bd33dd7a0617ebdbda92e0
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
GuLoader NSIS
Details
GuLoader
an XOR decryption key and an extracted component
GuLoader
a c2 URL, a useragent string, and a string XOR key
NSIS
extracted archive contents
Link:
https://research.acce.ciphertechsolutions.com/results/de0c81c4-6a16-4a00-975d-6136a32125cd/
Malware family:
n/a
ID:
1
File name:
a42330c0-43cc-ec5d-4c0c-03eb189b0674.eml
Verdict:
Malicious activity
Analysis date:
2026-03-04 12:15:21 UTC
Tags:
attachments attc-arch arch-exec evasion snake keylogger telegram stealer spyware
Link:
https://app.any.run/tasks/e1e32e6e-f033-4969-b894-f1ca8470210e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/66683/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a0de55e4f2b29ce0401d9a4
Tags:
injection obfusc virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file in the %temp% directory
Creating a file
Sending a custom TCP request
Delayed reading of the file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug guloader installer installer installer-heuristic masquerade microsoft_visual_cc nsis reconnaissance signed similar-threat
Link:
https://www.filescan.io/uploads/6a0de50a861ee596e64191e4/reports/f8738e7e-a7c6-4e8d-b3bc-34c8f9a9b492/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/3267be45cf6025a247c0703b6591ec2e43fa50ea6fbcdab88aaa47c6a140ed46
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-03-03T23:53:00Z UTC
Last seen:
2026-05-22T13:35:00Z UTC
Hits:
~100000
Link:
https://opentip.kaspersky.com/3267be45cf6025a247c0703b6591ec2e43fa50ea6fbcdab88aaa47c6a140ed46/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/995a2a5c-cf55-4ac1-8e9f-a132c1cfdf15
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1878305
Signature
AI detected suspicious PE digital signature
Multi AV Scanner detection for submitted file
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Download SVG
Score:
83%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3267be45cf6025a247c0703b6591ec2e43fa50ea6fbcdab88aaa47c6a140ed46
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3267be45cf6025a247c0703b6591ec2e43fa50ea6fbcdab88aaa47c6a140ed46/
Threat name:
Win32.Trojan.NSISInject
Create hunting rule
Status:
Malicious
First seen:
2026-03-04 04:22:41 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gjt34ropmas2er6aoa5wlepmfzb7uuhkn66nvoekvjd4nika5vda._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
error
GuLoader
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/260520-t8pmead18m/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Contacts third-party web service commonly abused for C2
Loads dropped DLL
Unpacked files
SH256 hash:
3267be45cf6025a247c0703b6591ec2e43fa50ea6fbcdab88aaa47c6a140ed46
MD5 hash:
db3c44f4d15b7406af8368b5f71f8f0c
SHA1 hash:
541914d9e93f81b2925b8c62ef24a553b80ce4e3
Link:
https://www.unpac.me/results/8fa5aaa5-8ead-44bb-bfc0-99c4470e6a72/
SH256 hash:
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 hash:
17ed1c86bd67e78ade4712be48a7d2bd
SHA1 hash:
1cc9fe86d6d6030b4dae45ecddce5907991c01a0
Link:
https://www.unpac.me/results/8fa5aaa5-8ead-44bb-bfc0-99c4470e6a72/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3267be45cf6025a247c0703b6591ec2e43fa50ea6fbcdab88aaa47c6a140ed46

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 3267be45cf6025a247c0703b6591ec2e43fa50ea6fbcdab88aaa47c6a140ed46

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/66683/

Comments