MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36876b6fce05638cc1fabd8ca4716233feaebfab40f56ae0180491d77f5f3565. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 19


Intelligence 19 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36876b6fce05638cc1fabd8ca4716233feaebfab40f56ae0180491d77f5f3565
SHA3-384 hash: e1e2240d9dd7aa8818698a956aca1ba88471c2409691e12e84af6fd571a4dee86e5802b619429c56b3c8d600a38bdd84
SHA1 hash: 02877d69a4239dded98c0faefb79cb0aece29879
MD5 hash: 31eac0d6366088d2561c3244a08bdfc4
humanhash: monkey-missouri-lithium-colorado
File name:2. Обоснование количества ввозимых образцов.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:542'591 bytes
First seen:2025-09-10 09:16:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1f23f452093b5c1ff091a2f9fb4fa3e9 (301 x GuLoader, 47 x RemcosRAT, 46 x VIPKeylogger)
ssdeep 12288:P+chYrPiGTJbmhXlUxk9NtUrOnAO5tqRB5y:Pjqe8IyxAYOLqvy
Threatray 4'299 similar samples on MalwareBazaar
TLSH T1DBB412813AC7D997DF7409304AE1E3701A7CBFE65C030A87B7997FE834705AEA90A255
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 1000f8f8fcfcfcf8 (2 x RemcosRAT, 1 x GuLoader)
Reporter lowmal3
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
2. .7z
Verdict:
Malicious activity
Analysis date:
2025-09-10 08:56:13 UTC
Tags:
arch-exec remcos rat
Link:
https://app.any.run/tasks/784a4601-b52b-4013-b53f-a1d788ec5505

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Guloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/26670/
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68c142296e66ba602d79ca96
Tags:
injection obfusc virus
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Searching for the window
Creating a file
Delayed reading of the file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug blackhole installer microsoft_visual_cc nsis overlay
Link:
https://www.filescan.io/uploads/68c14222a1a41633174f95e0/reports/6dff8aca-d7bc-426f-b281-f7b36651fa92/overview
Verdict:
Malicious
Labled as:
Malware_46.7
Link:
https://www.hybrid-analysis.com/sample/36876b6fce05638cc1fabd8ca4716233feaebfab40f56ae0180491d77f5f3565
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-10T05:01:00Z UTC
Last seen:
2025-09-10T05:01:00Z UTC
Hits:
~1000
Detections:
Trojan.Win32.Guloader.sb Trojan.NSIS.Makoob.sba Packed.NSIS.Krynis.sb Trojan.NSIS.Pakes.Krynis.sb HEUR:Trojan.Win32.GuLoader.gen Trojan-Downloader.Win32.Minix.sb HEUR:Trojan.Win32.Convagent.gen
Link:
https://opentip.kaspersky.com/36876b6fce05638cc1fabd8ca4716233feaebfab40f56ae0180491d77f5f3565/results?tab=lookup
Malware family:
NSIS
Create hunting rule
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/7b981603-e469-4c9d-a46e-eab8ac2177da
Result
Threat name:
GuLoader, Remcos
Create hunting rule
Detection:
malicious
Classification:
troj.evad.phis.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1774596
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: New RUN Key Pointing to Suspicious Folder
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected GuLoader
Yara detected Remcos RAT
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1774596 Sample: U0432#U0432#U043e#U0437#U04... Startdate: 10/09/2025 Architecture: WINDOWS Score: 100 40 fteamez7iurs08.duckdns.org 2->40 42 fteamez7iurs07.duckdns.org 2->42 44 8 other IPs or domains 2->44 60 Suricata IDS alerts for network traffic 2->60 62 Found malware configuration 2->62 64 Antivirus detection for URL or domain 2->64 68 12 other signatures 2->68 8 U0432#U0432#U043e#U0437#U0438#U043c#U044b#U0445 #U043e#U0431#U0440#U0430#U0437#U0446#U043e#U0432.exe 1 37 2->8         started        signatures3 66 Uses dynamic DNS services 42->66 process4 file5 24 C:\Users\user\AppData\Local\...\nsDialogs.dll, PE32 8->24 dropped 26 C:\Users\user\AppData\Local\...\UserInfo.dll, PE32 8->26 dropped 28 C:\Users\user\AppData\Local\...\System.dll, PE32 8->28 dropped 30 C:\Users\user\AppData\Local\...\BgImage.dll, PE32 8->30 dropped 70 Found direct / indirect Syscall (likely to bypass EDR) 8->70 12 U0432#U0432#U043e#U0437#U0438#U043c#U044b#U0445 #U043e#U0431#U0440#U0430#U0437#U0446#U043e#U0432.exe 4 12 8->12         started        signatures6 process7 dnsIp8 46 fteamez7iurs01.duckdns.org 192.169.69.26, 12760, 12761, 49819 WOWUS United States 12->46 48 fteamez7iurs02.duckdns.org 172.94.127.136, 12760, 49821, 49822 AMANAHA-NEWCA United States 12->48 50 2 other IPs or domains 12->50 32 C:\Users\user\AppData\Local\...\Teary.exe, PE32 12->32 dropped 34 C:\Users\user\AppData\Local\Temp\THEF46.tmp, MS-DOS 12->34 dropped 36 C:\Users\user\AppData\Local\Temp\THEF16.tmp, MS-DOS 12->36 dropped 38 2 other malicious files 12->38 dropped 72 Writes to foreign memory regions 12->72 74 Maps a DLL or memory area into another process 12->74 76 Installs a global keyboard hook 12->76 78 Found direct / indirect Syscall (likely to bypass EDR) 12->78 17 RmClient.exe 1 12->17         started        20 RmClient.exe 2 12->20         started        22 RmClient.exe 1 12->22         started        file9 signatures10 process11 signatures12 52 Tries to steal Instant Messenger accounts or passwords 17->52 54 Tries to steal Mail credentials (via file / registry access) 17->54 56 Tries to steal Mail credentials (via file registry) 20->56 58 Tries to harvest and steal browser information (history, passwords, etc) 20->58
Score:
84%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/36876b6fce05638cc1fabd8ca4716233feaebfab40f56ae0180491d77f5f3565
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36876b6fce05638cc1fabd8ca4716233feaebfab40f56ae0180491d77f5f3565/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/36876b6fce05638cc1fabd8ca4716233feaebfab40f56ae0180491d77f5f3565
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2025-09-10 07:57:38 UTC
File Type:
PE (Exe)
Extracted files:
10
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g2dww36oavryzqp2xwgki4lcgp7k5p5lid2wvyayasi5o727gvsq._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
0c67ccd6b722d25bbe932693afe8d0895555d12442699122c8810d2d6610e2a8
GuLoader
0cb6636748ff6a60ebf1a4644a7b4c877f8a19edd8c7a2eac10b34d1bd7cbfbf
GuLoader
29032ae14e315863a55a0851c3e1c9cb246beb4513a279d8b1bf7fac97be6ff7
GuLoader
2bab4b4ef0cd5ce5f2dff0ddcbdfb7295c0d141fb4c88ec305268b24a3e23a5c
GuLoader
43753d7fe1487c758cfebd575c0818b13ef5c3c278a0fa9539e04fe1a86553eb
GuLoader
55118f31295208ddb2a3e7f18a340056c791d338d8375080cdf618c2bc01bd08
GuLoader
79866667d5cd578a1c6eda54a748ff9d316fff39064eecd282bc2a9ad8a5ac7d
GuLoader
da9c5f609ebbcf19aef3d6992d451ccbe4fa77858660f6861146d1a486e1d98e
GuLoader
ebb0272ecef9d8bf07a71b9ead8718760d27c4fdc334fe2de7a8b93237e61044
GuLoader
error
GuLoader
+ 4'289 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:aurotun family:remcos collection discovery persistence rat stealer
Link:
https://tria.ge/reports/250910-k887daxmy5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Adds Run key to start application
Loads dropped DLL
Detected Nirsoft tools
NirSoft MailPassView
NirSoft WebBrowserPassView
Aurotun
Aurotun family
Remcos
Remcos family
Malware Config
C2 Extraction:
fteamez7iurs01.duckdns.org:12760
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ed3d1ca4-4921-431a-a243-37758015ec01
Unpacked files
SH256 hash:
36876b6fce05638cc1fabd8ca4716233feaebfab40f56ae0180491d77f5f3565
MD5 hash:
31eac0d6366088d2561c3244a08bdfc4
SHA1 hash:
02877d69a4239dded98c0faefb79cb0aece29879
Link:
https://www.unpac.me/results/14c7ddfb-f2f5-4ed1-8c59-176fb08f00bd/
SH256 hash:
91b8073e8e67945e14fb10963fc9101fae8c298bd4cd7080b4e47b5bdd4af85c
MD5 hash:
e9f3051a79f12aed819b91f028a463c1
SHA1 hash:
d088868584cdc04d391ec27cd318034a5ce562bc
Link:
https://www.unpac.me/results/14c7ddfb-f2f5-4ed1-8c59-176fb08f00bd/
SH256 hash:
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
MD5 hash:
75ed96254fbf894e42058062b4b4f0d1
SHA1 hash:
996503f1383b49021eb3427bc28d13b5bbd11977
Link:
https://www.unpac.me/results/14c7ddfb-f2f5-4ed1-8c59-176fb08f00bd/
SH256 hash:
b8fa7b9393fff910144768588c471ca7c9ec98a2b8b186b2172b8ba7a5279500
MD5 hash:
a6f622a2f12ac10bca04e23deff5cada
SHA1 hash:
abf851b5ccfb64004e9b49718a467bd754545887
Link:
https://www.unpac.me/results/14c7ddfb-f2f5-4ed1-8c59-176fb08f00bd/
SH256 hash:
feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be
MD5 hash:
ca95c9da8cef7062813b989ab9486201
SHA1 hash:
c555af25df3de51aa18d487d47408d5245dba2d1
Link:
https://www.unpac.me/results/14c7ddfb-f2f5-4ed1-8c59-176fb08f00bd/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/36876b6fce05/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/36876b6fce05638cc1fabd8ca4716233feaebfab40f56ae0180491d77f5f3565

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 36876b6fce05638cc1fabd8ca4716233feaebfab40f56ae0180491d77f5f3565

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/26670/

Comments