MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 384a47d5e006cedd748e2bcbc9b8d85210a681a0d144437ef3c217d162029cef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 14

Intelligence 14 IOCs YARA 2 File information Comments

SHA256 hash:	384a47d5e006cedd748e2bcbc9b8d85210a681a0d144437ef3c217d162029cef
SHA3-384 hash:	17c1445195faef038b6f725d0648fa08bbb96326d01673ac65fb0cc8192cbc9c8d7f6b7162509a8e3de33ce5a589d3c9
SHA1 hash:	040489052c30834c22e33cd79cd4198c3bbdbcdd
MD5 hash:	6b4268c33037e261e3b2bea0b2f37871
humanhash:	beryllium-triple-enemy-two
File name:	384a47d5e006cedd748e2bcbc9b8d85210a681a0d144437ef3c217d162029cef
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	1'050'480 bytes
First seen:	2025-10-09 15:15:42 UTC
Last seen:	2025-11-06 10:06:46 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e9c0657252137ac61c1eeeba4c021000 (55 x GuLoader, 26 x RedLineStealer, 17 x AgentTesla)
ssdeep	12288:+Rh2nZ2w+XMlrFtDhPCugjQzCjtR8dLTZ/oGH6OeDSsFD3DPXbgu92DrjXs1+pq1:KA2w+c111g0zK8tdVNI52Dr7fpq1
Threatray	170 similar samples on MalwareBazaar
TLSH	T1C625237157D0A2DAC8865573D236F7B897A0EC1308E753A79F403FABBCB9543AA42047
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	8af2ecfcfcf8d494 (5 x GuLoader, 3 x VIPKeylogger)
Reporter	adrian__luca
Tags:	exe GuLoader signed

Code Signing Certificate

Organisation:	Manerernes
Issuer:	Manerernes
Algorithm:	sha256WithRSAEncryption
Valid from:	2025-09-03T07:04:48Z
Valid to:	2026-09-03T07:04:48Z
Serial number:	23c39d56fe85e3d241849ea568b471c9405c58a8
Thumbprint Algorithm:	SHA256
Thumbprint:	0130e59cd2885d9e0e5d61014dc23ff655b5810997a46a2975e5b443db192c3a
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

108

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

FACTURA.pdf

Verdict:

Malicious activity

Analysis date:

2025-10-01 15:13:14 UTC

Tags:

arch-exec

Link:

https://app.any.run/tasks/6a36e9ff-c7ba-4a43-b5ad-d292ef055f28

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/31912/

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68e7d4cc8b7b147cc4b63512

Tags:

injection uloader virus nsis

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Searching for the window

Creating a file in the Windows directory

Creating a file

Delayed reading of the file

Creating a file in the %temp% subdirectories

Sending a custom TCP request

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context installer microsoft_visual_cc obfuscated overlay signed

Link:

https://www.filescan.io/uploads/68e7f528f377ab2310555258/reports/745ba5d4-e527-4943-95c6-a649ede7d799/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/384a47d5e006cedd748e2bcbc9b8d85210a681a0d144437ef3c217d162029cef

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-09-29T10:10:00Z UTC

Last seen:

2025-10-09T11:19:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/384a47d5e006cedd748e2bcbc9b8d85210a681a0d144437ef3c217d162029cef/results?tab=lookup

Malware family:

Unlabeled

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/3b5036fe-7823-46d5-b731-d190d7b69476

Score:

87%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/384a47d5e006cedd748e2bcbc9b8d85210a681a0d144437ef3c217d162029cef

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/6b4268c33037e261e3b2bea0b2f37871

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/384a47d5e006cedd748e2bcbc9b8d85210a681a0d144437ef3c217d162029cef/

Threat name:

Win32.Trojan.GuLoader

Status:

Malicious

First seen:

2025-09-29 13:30:31 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hbfepvpaa3hn25eofpf4togykiiknana2fceg7xtyil5cyqcttxq._file

Verdict:

malicious

Label(s):

cloudeye

GuLoader

2879655b51d313977f1ac8c04e13fbf1af6c060054afd368d7d38eed1d55e219

GuLoader

9ddad999a7d1a9a2b88e669e9dbe272f9f3611d29add150ba7ccee04c21ddd72

GuLoader

9ec3dfed3d799870e3cde0d3fa9f6b9ce7e944e052153a40f476c338ad9a813f

GuLoader

a527fedd14eff5696e64c07045ca1992cd6af0a199223022e50670a721b08b6b

GuLoader

ad0346645385b0a60d2f89ac1e5e1ea87b38ae06d15b2ac90474214b1ad77f40

GuLoader

ca26fd8d4675cfec9eee79a402ce93024e4b817655df0307ba3d9dba93f918b2

GuLoader

d984272af64062f23d6768f704b400f0b8b4e72b4390987287b1e2a0e44b02e1

GuLoader

error

GuLoader

+ 160 additional samples on MalwareBazaar

Result

Malware family:

vipkeylogger

Score:

10/10

Tags:

family:vipkeylogger collection discovery installer keylogger spyware stealer

Link:

https://tria.ge/reports/251009-v77l9sxscw/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

VIPKeylogger

Vipkeylogger family

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/1d6d322c-a3c1-4c90-9ca7-d001b4355a14

Unpacked files

SH256 hash:

384a47d5e006cedd748e2bcbc9b8d85210a681a0d144437ef3c217d162029cef

MD5 hash:

6b4268c33037e261e3b2bea0b2f37871

SHA1 hash:

040489052c30834c22e33cd79cd4198c3bbdbcdd

Link:

https://www.unpac.me/results/3201d834-a73c-4713-9fa5-ef9ba607921d/

SH256 hash:

8d4b1c275fd1cd0782a265080b56d1aec8d1c93edca5ef3b050d1d20d7b61f33

MD5 hash:

6e64e5d5f9498058a300b26b8741d9d5

SHA1 hash:

837ce28e5e02788da63a7f1d8f20207d2b0bf523

Link:

https://www.unpac.me/results/3201d834-a73c-4713-9fa5-ef9ba607921d/

SH256 hash:

ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

MD5 hash:

0063d48afe5a0cdc02833145667b6641

SHA1 hash:

e7eb614805d183ecb1127c62decb1a6be1b4f7a8

Link:

https://www.unpac.me/results/3201d834-a73c-4713-9fa5-ef9ba607921d/

Parent samples :

5312214b15330113f6eab71565e1e3c7d1ee3b59daa6703c271aaf3b192e6809
02fca6ef5d9d8b1eb29f7ac8ea0573b504ea7f06c215e091791653b40fe1329a
cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427
045a7318a9e2e550208c0c7e9fc805068df19fa73823ac3acaa049a46c4045ee
f2a883a0e4b01c72b0f063df3be5a0102e5c8fbaedc39c8d35c632b200599283
dffefbde27442b9095388b1871ffdc101c430b9a814138be4f962328a5b73fde
e0fb60da371912c158861c9660632d58e45cfcff12351cc9e03f497f319eb5de
904f69a4bed3844273cce1676e8920794815af4c1527e560bbc1bc44b5b8457a
3ab6ed7b7cb21244b34addf64ac6f64b1c38ee98236985511c4af47e8cc93cd4

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/384a47d5e006cedd748e2bcbc9b8d85210a681a0d144437ef3c217d162029cef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Ins_NSIS_Buer_Nov_2020_1 Create hunting rule
Author:	Arkbird_SOLG
Description:	Detect NSIS installer used for Buer loader

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/31912/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample