MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 475b7002fe1981c7acd3d420fead8bd384b6140ce84478fa9774f7dbd4be868e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 17

Intelligence 17 IOCs YARA 6 File information Comments

SHA256 hash:	475b7002fe1981c7acd3d420fead8bd384b6140ce84478fa9774f7dbd4be868e
SHA3-384 hash:	1eb2b4deeb59f5f3b7e2a3ce46d05a5b740baca963af831bd12bf6deaa1fef9d559ba0fcf209ceb4ae0c95117dc2a80e
SHA1 hash:	2056630fe4f6ac0dddd4041e00f3e4f490b5b19d
MD5 hash:	a0fb265c528e52e920fbd14cc9ad7ada
humanhash:	south-magnesium-alpha-pasta
File name:	PO_3N086_2F587.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	479'664 bytes
First seen:	2026-11-13 12:12:39 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	f4639a0b3116c2cfc71144b88a929cfd (147 x GuLoader, 58 x Formbook, 47 x VIPKeylogger)
ssdeep	6144:aXFKo5bhdG5A1rhV7zKv+h25twai6owN+MnaczN+SwZHcDcqlTMbWs3jmmes:aX5zr/K2Q5twaiXQRaenIHWlTMbVjmO
TLSH	T1DBA4E00A7750C907C3A866B84FB6E33853B8DD989E224B0326E07D6F7DAD7437D06295
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	d0b092d088b2a2f2 (1 x GuLoader)
Reporter	adrian__luca
Tags:	exe GuLoader signed

Code Signing Certificate

Organisation:	Skidded
Issuer:	Skidded
Algorithm:	sha256WithRSAEncryption
Valid from:	2026-11-01T02:56:37Z
Valid to:	2027-11-01T02:56:37Z
Serial number:	624770beda72173537204d4794b7ff1b4de1647b
Thumbprint Algorithm:	SHA256
Thumbprint:	5607485ae4881212e3e36c9f695070c69119d6ac53165b3b12d36235502055f5
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

199

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

GuLoader NSIS

Details

Link:

https://research.acce.ciphertechsolutions.com/results/b6d36850-ddff-46ee-a82d-1956ca448250/

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-11-13 12:25:14 UTC

Tags:

opendir

Link:

https://app.any.run/tasks/f96d7603-8da7-4ed5-b5e4-a17466fd5c51

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/99840/

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af6ff890a71acf937da7264

Tags:

injection uloader virus nsis

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Searching for the window

Creating a file in the %temp% subdirectories

Creating a file

Delayed reading of the file

Deleting a recently created file

Sending a custom TCP request

Gathering data

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/475b7002fe1981c7acd3d420fead8bd384b6140ce84478fa9774f7dbd4be868e

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-11-04T07:00:00Z UTC

Last seen:

2026-11-05T05:05:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/475b7002fe1981c7acd3d420fead8bd384b6140ce84478fa9774f7dbd4be868e/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/d2ef1820-0bde-4778-a630-da25676ff568

Result

Threat name:

GuLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/2005355

Signature

AI detected suspicious PE / MSI digital signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

Found direct / indirect Syscall (likely to bypass EDR)

Initial sample is a PE file and has a suspicious name

Multi AV Scanner detection for submitted file

Sigma detected: ImagingDevices Unusual Parent/Child Processes

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Unusual module load detection (module proxying)

Writes to foreign memory regions

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/475b7002fe1981c7acd3d420fead8bd384b6140ce84478fa9774f7dbd4be868e

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/a0fb265c528e52e920fbd14cc9ad7ada

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/475b7002fe1981c7acd3d420fead8bd384b6140ce84478fa9774f7dbd4be868e/

Threat name:

Win32.Trojan.Malgent

Status:

Malicious

First seen:

2026-11-04 17:49:29 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=i5nxaax6dga4plgt2qqp5lml2oclmfam5bchr6uxot35xvf6q2ha._file

Verdict:

malicious

Label(s):

CloudEyE

Link:

https://reports.threatray.com/effb26a1-6296-462e-bb64-95b5d0f5d782

Result

Malware family:

guloader

Score:

10/10

Tags:

family:guloader defense_evasion discovery downloader privilege_escalation

Link:

https://tria.ge/reports/261113-pd2ahabs81/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Loads dropped DLL

Family: Guloader,Cloudeye

Malware Family:

n/a

Verdict:

Malicious

Tags:

invalid_signature rat evasion

YARA:

win_token

Link:

https://app.threat.zone/submission/377a623f-12b8-4b6e-ba35-dc9811cfc491

Malware Family:

minix

Malicious:

True

Tags:

signed obfuscated invalid-signature file-overlay exe

Link:

https://intel.virussign.com/intelligence/file/475b7002fe1981c7acd3d420fead8bd384b6140ce84478fa9774f7dbd4be868e

Unpacked files

SH256 hash:

475b7002fe1981c7acd3d420fead8bd384b6140ce84478fa9774f7dbd4be868e

MD5 hash:

a0fb265c528e52e920fbd14cc9ad7ada

SHA1 hash:

2056630fe4f6ac0dddd4041e00f3e4f490b5b19d

Link:

https://www.unpac.me/results/565ee99e-9aba-45ad-af47-d60f3b8bf96d/

SH256 hash:

9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

MD5 hash:

4add245d4ba34b04f213409bfe504c07

SHA1 hash:

ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

Link:

https://www.unpac.me/results/565ee99e-9aba-45ad-af47-d60f3b8bf96d/

Malware family:

GuLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/475b7002fe19/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/475b7002fe1981c7acd3d420fead8bd384b6140ce84478fa9774f7dbd4be868e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_NSIS_Nullsoft_Installer Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects NSIS installers by .ndata section + NSIS header string

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	NSIS Create hunting rule
Author:	kevoreilly
Description:	NSIS Integrity Check function

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Win_Clipboard_Clipper_Thengavar Create hunting rule
Author:	Thengavar
Description:	Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

exe 475b7002fe1981c7acd3d420fead8bd384b6140ce84478fa9774f7dbd4be868e

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/99840/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample