MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 515bbef4ce21e056dc31c85364a95a4d0ae71f18772388b54121e5bcccfe604c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 515bbef4ce21e056dc31c85364a95a4d0ae71f18772388b54121e5bcccfe604c
SHA3-384 hash: 235b9426363eaaa5598b279a69ea151fb1b7339992a00f8a228de03bcb6517ec73b1f091e81abf81f2b1c346679eaeca
SHA1 hash: f4a6f6e327ebaaf133d45c82b89adad0ee4b93f6
MD5 hash: 5e1d30dcd0e377259a0e68a0e8094c5f
humanhash: bluebird-paris-march-coffee
File name:rARRIVALNOTICE.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:995'912 bytes
First seen:2026-02-02 21:00:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b34f154ec913d2d2c435cbd644e91687 (587 x GuLoader, 130 x RemcosRAT, 84 x EpsilonStealer)
ssdeep 24576:n1xv2DSd+gp5GjzXpAkTfco6ll/rAoIn624ZwXbjWbfQEnko:1N2SPp5ezXpfc5cHn62v24C
Threatray 2'528 similar samples on MalwareBazaar
TLSH T1FC251292750CEEE3E87ACD3134BA4DBD47327F7E5A98150AF2887B6D19F3140A126706
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 5d1c6ce0d1d4e0e1 (1 x GuLoader, 1 x RemcosRAT)
Reporter FXOLabs
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:Plirrende
Issuer:Plirrende
Algorithm:sha256WithRSAEncryption
Valid from:2025-12-18T07:04:35Z
Valid to:2026-12-18T07:04:35Z
Serial number: 591d04071d62c3dcd5dabd1b8dcdb40fef4afaf0
Thumbprint Algorithm:SHA256
Thumbprint: 7cf5bc0d9f28b6bd521a1059918fe2a52c8ca00ba2877e7923aada5b79fb0e63
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
161
Origin country :
BR BR
Vendor Threat Intelligence
Malware configuration found for:
GuLoader NSIS
Details
GuLoader
an XOR decryption key and an extracted component
GuLoader
a c2 URL, a useragent string, and a string XOR key
NSIS
extracted archive contents
Link:
https://research.acce.ciphertechsolutions.com/results/8e4560a2-fb0e-48cc-88f7-8e8a960f5cd8/
Malware family:
remcos
Create hunting rule
ID:
1
File name:
rARRIVALNOTICE.exe
Verdict:
Malicious activity
Analysis date:
2026-02-02 21:00:45 UTC
Tags:
remcos rat auto-reg
Link:
https://app.any.run/tasks/15b056ca-0d24-45a1-a3c5-27d54e1d299e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/51353/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=698110774cec271dd70539eb
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Searching for the window
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole installer installer installer-heuristic microsoft_visual_cc nsis signed smb soft-404
Link:
https://www.filescan.io/uploads/6981106f981ff1d38a457021/reports/3cafec54-4f9b-4acc-8425-d3a67dbcbe2b/overview
Verdict:
Malicious
Labled as:
Malware_54.1
Link:
https://www.hybrid-analysis.com/sample/515bbef4ce21e056dc31c85364a95a4d0ae71f18772388b54121e5bcccfe604c
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-02-02T16:23:00Z UTC
Last seen:
2026-02-04T15:06:00Z UTC
Hits:
~10000
Detections:
HEUR:Backdoor.Win32.Remcos.gen Trojan-Downloader.Win32.Minix.sb Trojan.Win32.Guloader.sb
Link:
https://opentip.kaspersky.com/515bbef4ce21e056dc31c85364a95a4d0ae71f18772388b54121e5bcccfe604c/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b15bb9e8-627c-4e07-99ed-2d7f7b58dcff
Score:
91%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/515bbef4ce21e056dc31c85364a95a4d0ae71f18772388b54121e5bcccfe604c
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/5e1d30dcd0e377259a0e68a0e8094c5f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/515bbef4ce21e056dc31c85364a95a4d0ae71f18772388b54121e5bcccfe604c/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/515bbef4ce21e056dc31c85364a95a4d0ae71f18772388b54121e5bcccfe604c
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-02-02 21:00:42 UTC
File Type:
PE (Exe)
Extracted files:
34
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kfn355goehqfnxbrzbjwjkk2jufoohyyo4ryrnkbehs3zth6mbga._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
remcos
Create hunting rule
Similar samples:
1169877e8bf28bec8ccaf68ac8e6a5e25be4ec28ce07b451506e16114181bf8e
GuLoader
3e5b41e258fb843f6305b8381be4377aeaf6beb83b59c7578dfc226d2bd9a55a
GuLoader
4d3b8bfce2a9a553d00af15c4880998ccb4c7062776a4ac6522d92b235e7ef21
GuLoader
515bbef4ce21e056dc31c85364a95a4d0ae71f18772388b54121e5bcccfe604c
GuLoader
7fef427b27a7c8f894418bca3de3a29d75d0f992cb8d3068d94bc18aa1f0f34f
GuLoader
96f03e7de39c9da07c8980e751e9bd492672af5e56841f0a80820fe6031bfdab
GuLoader
9e4b906cc1513c2c1da331ea25881ead2ba68599a9429f5af619b97816eeebfc
GuLoader
ec624e32754a0730e350b500833c03c8e530c3fbcedb11d681f0d65bb9291f72
GuLoader
error
GuLoader
+ 2'518 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:remcos botnet:remotehost discovery downloader persistence rat
Link:
https://tria.ge/reports/260202-ztjqhacv5a/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Loads dropped DLL
Checks computer location settings
Executes dropped EXE
Guloader family
Guloader,Cloudeye
Remcos
Remcos family
Malware Config
C2 Extraction:
130.12.182.167:2404
130.12.182.167:5000
Unpacked files
SH256 hash:
515bbef4ce21e056dc31c85364a95a4d0ae71f18772388b54121e5bcccfe604c
MD5 hash:
5e1d30dcd0e377259a0e68a0e8094c5f
SHA1 hash:
f4a6f6e327ebaaf133d45c82b89adad0ee4b93f6
Link:
https://www.unpac.me/results/e5abf7cc-e4cb-47f3-9532-cb2312c315bf/
SH256 hash:
1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 hash:
466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 hash:
eb607467009074278e4bd50c7eab400e95ae48f7
Link:
https://www.unpac.me/results/e5abf7cc-e4cb-47f3-9532-cb2312c315bf/
SH256 hash:
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 hash:
0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 hash:
48df0911f0484cbe2a8cdd5362140b63c41ee457
Link:
https://www.unpac.me/results/e5abf7cc-e4cb-47f3-9532-cb2312c315bf/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/515bbef4ce21/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/515bbef4ce21e056dc31c85364a95a4d0ae71f18772388b54121e5bcccfe604c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 515bbef4ce21e056dc31c85364a95a4d0ae71f18772388b54121e5bcccfe604c

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/51353/

Comments