MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41a58703b602abae9849b85ee30ad4193831499c3df3ddd5a607bef98d44b53e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	41a58703b602abae9849b85ee30ad4193831499c3df3ddd5a607bef98d44b53e
SHA3-384 hash:	8ccbe5cacecf9f5ff1496b920a2e96790b142ff4fc0d548a3b763b613f6cc257a04d47c7c1a299c705297ce0b4a07dcb
SHA1 hash:	5c3aeca5b990b8eba04e4712ab1d4990e3a14634
MD5 hash:	426c873d4e56cdfaf652990049222875
humanhash:	speaker-beer-bravo-one
File name:	WurthXInvoiceX4052616348.rar
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	573'036 bytes
First seen:	2026-05-21 13:39:10 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:xprTx7AJRdya0jGHp39xhpb3dA4eL8A/bMN/UW5Khaflhz:xNlAJYjGHpNxhpzudgA/usgRjz
TLSH	T167C42328297D095A29E7D5C5A0BCC6912F321E33CEAAF1C52D69E1A23BCCD1074F59CC
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	GuLoader rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

24

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Wurth Invoice 4052616348.exe
File size:	697'820 bytes
SHA256 hash:	b0fceff0ca55741de03d3c37d66b518e2edc3f31a75c8acea4d857397d11740f
MD5 hash:	0270d9f65bf63999240fafabbea1bcab
MIME type:	application/x-dosexec
Signature	GuLoader

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/e5f2c478-99fb-4a68-9c13-52acb59cab02/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.DownLoader47.52696.24991.23047.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a0f0c5598070a72bb9c5b44

Tags:

injection uloader virus

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context anti-debug evasive installer installer installer-heuristic masquerade microsoft_visual_cc nsis reconnaissance smb

Link:

https://www.filescan.io/uploads/6a0f0c0c056ea44c45373e11/reports/d1c1df13-ca8b-4c5d-8961-3d1c1d65fb25/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/41a58703b602abae9849b85ee30ad4193831499c3df3ddd5a607bef98d44b53e

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2024-11-19T09:17:00Z UTC

Last seen:

2026-01-28T09:03:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/41a58703b602abae9849b85ee30ad4193831499c3df3ddd5a607bef98d44b53e/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/41a58703b602abae9849b85ee30ad4193831499c3df3ddd5a607bef98d44b53e/

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/41a58703b602abae9849b85ee30ad4193831499c3df3ddd5a607bef98d44b53e

ReversingLabs TitaniumCloud Win32.Trojan.Leonem

Threat name:

Win32.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-11-19 02:32:22 UTC

File Type:

Binary (Archive)

Extracted files:

7

AV detection:

19 of 24 (79.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=igsyoa5wakv25gcjxbpogcwude4dcsm4hxz53vnga67ptdkewu7a._file

Hatching Triage vipkeylogger

Result

Malware family:

vipkeylogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:vipkeylogger collection discovery keylogger spyware stealer

Link:

https://tria.ge/reports/260521-r9n16ags2k/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Family: VIPKeylogger

Malware Config

C2 Extraction:

https://api.telegram.org/bot7773291387:AAFW0tyP5tccfsSYvPespY2G7aDGr5DPwdk/sendMessage?chat_id=7981072606

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/41a58703b602abae9849b85ee30ad4193831499c3df3ddd5a607bef98d44b53e