🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53531b5d108aee1e5036988652e7763e0088b7ed24a48d3ddc2ecb8a89e5cf73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53531b5d108aee1e5036988652e7763e0088b7ed24a48d3ddc2ecb8a89e5cf73
SHA3-384 hash: 4000efaf7445ea109204ccd99255978d10d92a78e0de0cc4252b4ded68530a5a7fbe4689a428856f073ee02bae29e467
SHA1 hash: 4926f59b3eceead82b0ac51aa4ee2525f6c020bc
MD5 hash: 0700d64d4d0b584cddd7eb7d7bea1c4e
humanhash: connecticut-maryland-twelve-india
File name:INV CAT-26104.pdf.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:817'749 bytes
First seen:2025-11-12 15:50:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:GpHiAvsuatOb3OeQQzMRY0/0lnm6GVuLt:GCuatOb3OeQQgX/0ExVy
TLSH T1E005330507F46C5E37F86671808A6AEDBD4DD00D60DB57363DB7298AC8169CF4BF2A88
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter cocaman
Tags:GuLoader rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Purchase Dept <info@thermocorion.com>" (likely spoofed)
Received: "from mail.thermocorion.com (vmi2882848.contaboserver.net [89.117.55.190]) "
Date: "11 Nov 2025 12:57:26 +0100"
Subject: "RE: New Order Availability Inquiry"
Attachment: "INV CAT-26104.pdf.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
CH CH
File Archive Information

This file archive contains 51 file(s), sorted by their relevance:

File name:gaigas.txt
File size:712 bytes
SHA256 hash: cca7ad3e8d50e063ab07f24ef57b0697c1e96fc78881b4f81a13cd3b431a2170
MD5 hash: 860934ad0fbb01368489274d7a766409
MIME type:text/plain
Signature GuLoader
File name:syndetically.unv
File size:887'643 bytes
SHA256 hash: b4c269716bd700ac661bfd68e13099534488bf37da89b9dae43f8c4e17674a73
MD5 hash: 0e4acdd8d12782aeeb69f56ae5eea4fb
MIME type:application/octet-stream
Signature GuLoader
File name:biskuit.anv
File size:65'526 bytes
SHA256 hash: 577927621caca5e31b6dd9c34526a128877ab1538feea9cb8ceaa41bbd1727af
MD5 hash: 930e1234abe14d837994de6687bd6657
MIME type:application/octet-stream
Signature GuLoader
File name:rackets.due
File size:116'253 bytes
SHA256 hash: 114ad817a5e9a94e414d34ed0e28bae35a9411883aa98953a0c37141cd96d077
MD5 hash: 5e228a5b1eaac6b3e75fe69465654a8f
MIME type:application/octet-stream
Signature GuLoader
File name:codiniac.jpg
File size:12'981 bytes
SHA256 hash: 79cacc2be276a644f5adc183aa5bffaa8fbe59d3de7118f5ba5ccf64226f92f5
MD5 hash: c9864310bb826d2524d1411ddb66c378
MIME type:image/jpeg
Signature GuLoader
File name:iconometer.vin
File size:586'666 bytes
SHA256 hash: 8cce5fb5c004de6b12fc375de97fa246aa39aabd518f3658d38990f72c27c430
MD5 hash: 65202feb1cf716db3bf7e733b157ad5f
MIME type:application/octet-stream
Signature GuLoader
File name:magani.jpg
File size:22'258 bytes
SHA256 hash: 9329d1ed1caafc97d4a98c8318ed1f84ad6de176e967cec2f171144e97a966c4
MD5 hash: dd87ae6935b521f6fcaec93671575d15
MIME type:image/jpeg
Signature GuLoader
File name:Motorens65.duc
File size:826'578 bytes
SHA256 hash: 12fcf4c5adf94241e761a480d65856bf60965d91814ac9b806038f1706e54e98
MD5 hash: 306dd2eaa0fe074068dfa7e93d3e30e3
MIME type:application/octet-stream
Signature GuLoader
File name:Genbrugspapirers.jpg
File size:52'026 bytes
SHA256 hash: 4eb1a26769387b5b9c457e94b2d8cf89876b0554a0ad8558581f91a29546b8df
MD5 hash: 21aaf7f23af3d6ab71176ca78ab36ade
MIME type:image/jpeg
Signature GuLoader
File name:inconsequently.hau
File size:717'859 bytes
SHA256 hash: 8c28e2160eb737475d27797c7f660463e4d9530b675443d12b668a1b7272f7e8
MD5 hash: 09db77892759a473c142b95fb60c8a35
MIME type:application/octet-stream
Signature GuLoader
File name:LangDLL.dll
File size:5'632 bytes
SHA256 hash: 6dff504c6759c418c6635c9b25b8c91d0d9ef7787a3a93610d7670bb563c09df
MD5 hash: f1e9eed02db3a822a7ddef0c724e5f1f
MIME type:application/x-dosexec
Signature GuLoader
File name:kommandofortolkeren.Erg
File size:215'488 bytes
SHA256 hash: 5b03680d0916e8e2c563c7af47b12fbb96c3a0b09e36f4de07444658ae0994f2
MD5 hash: 605c516585a98df4e90157699ce64772
MIME type:application/octet-stream
Signature GuLoader
File name:Glabreity.uns
File size:219'215 bytes
SHA256 hash: 627549a57d514a0ea23cb78d4232705c686ffd14d96686ee6144a0f81ee213c4
MD5 hash: d609f0694e37e1ef7bdbc736f5e059eb
MIME type:application/octet-stream
Signature GuLoader
File name:melanocomous.ban
File size:691'126 bytes
SHA256 hash: aa5db4b23bf590e4bb5e0470e6845438baac31598977b30ef33c5241e3c2e80e
MD5 hash: 190deb7aa52208a754e05455a93e600d
MIME type:application/octet-stream
Signature GuLoader
File name:bondegaarden.ini
File size:422 bytes
SHA256 hash: 306d971f55fa10ac58243910b361be734cca70e6bad8eaa9e1b2e34cb0ea0309
MD5 hash: 3a09638d1f2ddd2609e0f52d077ae417
MIME type:application/x-wine-extension-ini
Signature GuLoader
File name:autentificeringernes.ren
File size:517'966 bytes
SHA256 hash: c67b6db43233519a74a23462206a1e5258c1c91b08ee5c761b8d5cfd65e6fa85
MD5 hash: bc9fa769edb4bf6a25fef1f407a660db
MIME type:application/octet-stream
Signature GuLoader
File name:System.dll
File size:11'776 bytes
SHA256 hash: bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 hash: 17ed1c86bd67e78ade4712be48a7d2bd
MIME type:application/x-dosexec
Signature GuLoader
File name:ideposernes.tit
File size:775'526 bytes
SHA256 hash: b1e1f314bbd85c7ec30a9f0215f77fff90d9f212cb4d7028f924b48e1a86eee0
MD5 hash: 2d460cd85fe7f55bc5f063b0fa88b7ac
MIME type:application/octet-stream
Signature GuLoader
File name:inapproachable.txt
File size:291 bytes
SHA256 hash: 36b114da3270a3d55e0e89bbac2138c9d0d80fbc07888986b913ba32552a3112
MD5 hash: c4afd86cc504fad412c91bc5ade34eff
MIME type:text/plain
Signature GuLoader
File name:hestekastaniernes.ven
File size:81'480 bytes
SHA256 hash: 8fa52ede6ba61b453ab08df9cbfb20f25aa2240414c59d2128f9eb719cadace3
MD5 hash: 58baa631e74f28d1ac1d80b7fcc3bc9e
MIME type:application/octet-stream
Signature GuLoader
File name:nonaid.run
File size:298'241 bytes
SHA256 hash: 8c073040d23b784cd5ee9db97fe1bdfb85c78c7f5603fb8cfcfa584b9f7b3e02
MD5 hash: 9e01c94c2dd147689f6f411fda1360ce
MIME type:application/octet-stream
Signature GuLoader
File name:mineralizable.txt
File size:304 bytes
SHA256 hash: 636b585e000880abcf847d4bc56cce78baf4972f85e1e16fa3d06cbf3492e39e
MD5 hash: 6345a2b22c1c47ace6429633b800728d
MIME type:application/x-wine-extension-ini
Signature GuLoader
File name:creephole.ban
File size:376'044 bytes
SHA256 hash: 133d6ef6315a494bdb6e80f7c4df644bc8aead1bc4c4611725c95195906019e3
MD5 hash: d63396d30c3151a1224057f6570b5f43
MIME type:application/octet-stream
Signature GuLoader
File name:tacklingers.aqu
File size:801'615 bytes
SHA256 hash: a02c736214b25ad3d2b329397f4271ededbb54fa80d288580c9cb6cda9d56e8d
MD5 hash: 83e49a24e257b6a569115a9f1583c5c2
MIME type:application/octet-stream
Signature GuLoader
File name:womenswear.ini
File size:389 bytes
SHA256 hash: 32314e4947207bbc43edd2b7bccda85f8a2303e42f41439f6f54a900e2feac4b
MD5 hash: 8abd1ae557d208703f0f3741c15adc8a
MIME type:text/plain
Signature GuLoader
File name:Breakover.arc
File size:855'754 bytes
SHA256 hash: 8e0408f65235b7d195306d14171ef0a50214edcb52d44216757ca2de529a3a66
MD5 hash: e3203bd83d43192c6bb37ed73865ff32
MIME type:application/octet-stream
Signature GuLoader
File name:orthometry.txt
File size:482 bytes
SHA256 hash: c4a9c6639faa09e79cc78358a37ebbf837f46b49236fd70a6a7c82f494483dba
MD5 hash: 213d87b938549ebbc2c6668386fcffdf
MIME type:application/x-wine-extension-ini
Signature GuLoader
File name:brevkasse.ere
File size:442'846 bytes
SHA256 hash: d475d3ed3bbbec773c4c896bc1e01dc9495840c4dfbfbf9b20cde983ffffe7ca
MD5 hash: 230ad38d7306c7a0e4a4d32a13eec736
MIME type:application/octet-stream
Signature GuLoader
File name:kymnel.jpg
File size:2'782 bytes
SHA256 hash: 9f43ec51e591bdb3f19142eac7517022bc5b3aa3f660e10094f3dd15881f9dd2
MD5 hash: 981fddfa9677895efa7855208592f9cf
MIME type:image/jpeg
Signature GuLoader
File name:lekythoi.bea
File size:519'910 bytes
SHA256 hash: 301103a64c5682809d9fc9e7b74ef8b35664b9cc6e770b6363b28010e8d95d30
MD5 hash: 9f99fb95d41c0b905b40867883b01b10
MIME type:application/octet-stream
Signature GuLoader
File name:clarkias.ret
File size:834'032 bytes
SHA256 hash: ff6dbeb929595b2f7e196d0a866e572b88a2abc86c07e6afab090babf6a3abdd
MD5 hash: 97bc3d2f3762b48b264bd7e9e422b127
MIME type:application/octet-stream
Signature GuLoader
File name:unrelegable.hol
File size:439'410 bytes
SHA256 hash: ee2ac1c625190a4cbcd486b797fd5f46ebb3ca292e40674d5b7bbf05758278df
MD5 hash: c25dbd3e8848f00457a0cdc71dfa69aa
MIME type:application/octet-stream
Signature GuLoader
File name:lysestagernes.res
File size:179'935 bytes
SHA256 hash: 8a05eabedfc89ca5a6bce88b5d292680827a5f62217591f9710babe305fe5ed4
MD5 hash: fcbdb5b37b33acf39ab4cc570b91c263
MIME type:application/octet-stream
Signature GuLoader
File name:garnvinde.txt
File size:358 bytes
SHA256 hash: 032ac9bbb79a843d4476b4429075b1af089572b1bc2ffafec1cc287c10d1ab52
MD5 hash: d1f0288d10bb6aee3261c395cb63ab97
MIME type:application/x-wine-extension-ini
Signature GuLoader
File name:korps.asc
File size:103'965 bytes
SHA256 hash: ef75b00023d60c28e413f1b178ca8427adbc1b4b8efedbe1acb7bf607d4ad9df
MD5 hash: ef99de3c10df1e3d7845e797af04d74e
MIME type:image/x-tga
Signature GuLoader
File name:Pristes.Tat
File size:36'074 bytes
SHA256 hash: 54ca86a70eb1a619aa9fdec1b9cb57e12e63261a4678960204371383a987f819
MD5 hash: e32742ebb7ac963c1a79045564e058cd
MIME type:text/plain
Signature GuLoader
File name:hypercorrect.jpg
File size:17'555 bytes
SHA256 hash: a73b2bc10b816e62dc2155fa33bf4ebb93dac26edc5156f47721d48daf17df85
MD5 hash: 8dd69c23f38cc30eec1365de82cf59cf
MIME type:image/jpeg
Signature GuLoader
File name:chich.bel
File size:321'318 bytes
SHA256 hash: 27fd53b17d05bd5c25a55b4146aeac2069929ad88115df841a71be4a67a1d3f5
MD5 hash: 942770937e8cd4253bd23dfb955fe388
MIME type:application/octet-stream
Signature GuLoader
File name:Agurkesalaten79.eks
File size:796'722 bytes
SHA256 hash: 3f84a99ae7ca09663530c3cd62d4e68ab3ad5877811790be77597702241d8c28
MD5 hash: 62d8a4ae7a3c1c3ecf0ab3d92ce13c92
MIME type:application/octet-stream
Signature GuLoader
File name:cand.jpg
File size:3'481 bytes
SHA256 hash: 5d1a745c6756e56b76587060a1a37aba3d1da925b0894a83f28dfe46e99e6537
MD5 hash: 67062b9b65012f7c29f3bcfc2d00d13f
MIME type:image/jpeg
Signature GuLoader
File name:Nonsync130.apo
File size:282'754 bytes
SHA256 hash: daf7f3ebe17b299b6ff4ba7c773dd448458b4ea12f2d33d0faba6610681d7979
MD5 hash: a57e2275027719ec9b83d25c8f2c08b0
MIME type:application/octet-stream
Signature GuLoader
File name:systemkonsulentens.ngl
File size:128'236 bytes
SHA256 hash: dbd8e2a993ea4f955caf0167d42faf155607e624269d35cf86b9a5f64fb95f07
MD5 hash: 45b22182c139116ecbe895a04171a52c
MIME type:application/octet-stream
Signature GuLoader
File name:vamper.krv
File size:863'317 bytes
SHA256 hash: 5f9fdbebbf55fff413168349d80f7b277ded6e7166bf00e8ed177fabe505eaf4
MD5 hash: bec79ca1de9fb97887183bdc0090726b
MIME type:application/octet-stream
Signature GuLoader
File name:Lysteligst.txt
File size:357 bytes
SHA256 hash: db3ba85f5f9445f4f559daa8e22b78f01037460f543dd112708d8c434c105a8e
MD5 hash: 02c75d2f500504159a7233ee578ad6fa
MIME type:text/plain
Signature GuLoader
File name:stradametrical.ini
File size:549 bytes
SHA256 hash: 78a482e3ce286c6f1756b28e03899915faf245bf8741634cf5a5bfa63b82b19c
MD5 hash: 0f60012460443f6008163e12a03dbc6c
MIME type:text/plain
Signature GuLoader
File name:INV CAT-26104.pdf.scr
File size:852'984 bytes
SHA256 hash: bd8ff6ebbd58786ceb7b9d931c41674058b124d362c7226ed9d0b80f2eb92663
MD5 hash: 01352ff90624d23d05f6f7f536165b2a
MIME type:application/x-dosexec
Signature GuLoader
File name:Comfort.dec
File size:512'010 bytes
SHA256 hash: 8cd3b47f00c6cf8463afb36f9876a746f621c4cde5b2e36005ca62c955867ed3
MD5 hash: 728213e6883355dc695ffc43ffe7d16d
MIME type:application/octet-stream
Signature GuLoader
File name:rovdriftens.amb
File size:604'010 bytes
SHA256 hash: 189830a88f0f46ca1fd1cae43cfaba296d87e0f98ae3afcfa8de94eca44b2171
MD5 hash: a3dc6c3bf515b2027233ac8d978e1c06
MIME type:application/octet-stream
Signature GuLoader
File name:mycological.blo
File size:439'410 bytes
SHA256 hash: d656cb6974015fdfe66b950af4e3ba6c1bf8e5ab31a2fc87e58febe000bb6ee8
MD5 hash: dff26d6bbc2c98a4a5aa35cf3f31824c
MIME type:application/octet-stream
Signature GuLoader
File name:omneity.txt
File size:342 bytes
SHA256 hash: 465ce6b2b88de73b33438bea4afb151af2900ec0acd4e1fb8272859ee10dff77
MD5 hash: c2f3a9dfb7fa8d74290710d2444d03cf
MIME type:application/x-wine-extension-ini
Signature GuLoader
File name:Nicotian.jpg
File size:7'439 bytes
SHA256 hash: 05d883f4da73b69d0cf2210ab9ea95a54fef8c866cdbd3c2bb2c8143e16136bd
MD5 hash: 91b4043dc4b046a980cb17232193268d
MIME type:image/jpeg
Signature GuLoader
Vendor Threat Intelligence
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6914acfa28ddbbca4d8d69f5
Tags:
underscore injection obfusc blic
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole installer installer installer-heuristic masquerade microsoft_visual_cc nsis overlay signed
Link:
https://www.filescan.io/uploads/6914acf8f0f11f085d689aa7/reports/6570e62f-514b-4723-8986-41076af681f0/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/53531b5d108aee1e5036988652e7763e0088b7ed24a48d3ddc2ecb8a89e5cf73
Verdict:
Malicious
File Type:
rar
First seen:
2025-11-10T21:51:00Z UTC
Last seen:
2025-11-14T13:57:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/53531b5d108aee1e5036988652e7763e0088b7ed24a48d3ddc2ecb8a89e5cf73/results?tab=lookup
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Rar Archive
Link:
https://app.malva.re/file/0700d64d4d0b584cddd7eb7d7bea1c4e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53531b5d108aee1e5036988652e7763e0088b7ed24a48d3ddc2ecb8a89e5cf73/
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2025-11-11 06:14:47 UTC
File Type:
Binary (Archive)
Extracted files:
51
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=knjrwxiqrlxb4ubwtcdffz3whyairn7nessi2po4f3fyvcpfz5zq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/53531b5d108aee1e5036988652e7763e0088b7ed24a48d3ddc2ecb8a89e5cf73

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 53531b5d108aee1e5036988652e7763e0088b7ed24a48d3ddc2ecb8a89e5cf73

(this sample)

GuLoader

Executable exe bd8ff6ebbd58786ceb7b9d931c41674058b124d362c7226ed9d0b80f2eb92663

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bd8ff6ebbd58786ceb7b9d931c41674058b124d362c7226ed9d0b80f2eb92663
  
Dropping
GuLoader
  
Dropping
MD5 01352ff90624d23d05f6f7f536165b2a

Comments