🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5947bb8cb88ff7791b2ad91086d3597cc3c7dd4dae2b01fc3f9b9a183cd95dc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 6


Intelligence 6 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5947bb8cb88ff7791b2ad91086d3597cc3c7dd4dae2b01fc3f9b9a183cd95dc5
SHA3-384 hash: e85252a62ce6b242929ee2a5469f5dc67b20bb0889824346ba3b051996267eaf8a88b5e0fc9af83aca1860aa73407c0a
SHA1 hash: 499c12af5f6bac25291221e2599edaa36c02353d
MD5 hash: fbecc54f516106595b2728b7dde83a54
humanhash: mockingbird-mexico-vermont-hawaii
File name:Śledzenie_DHL.img.iso
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'638'400 bytes
First seen:2026-05-20 17:42:20 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:T5UHg7ycXa8ZYMexXYvRCEOYkYRU2fNYwYtYPY:TuHzfV5ovRH1bqyuXOg
TLSH T11C7523235AA8A498DF0B87FA4772D178E2E2681113342AEF729D1F3E1B1543764B513F
TrID 47.7% (.ISO/UDF) UDF disc image (2114500/1/6)
46.2% (.NULL) null bytes (2048000/1)
5.7% (.HTP) HomeLab/BraiLab Tape image (256000/1)
0.1% (.ATN) Photoshop Action (5007/6/1)
0.0% (.ISO) ISO 9660 CD image (2545/36/1)
Magika iso
Reporter TomU
Tags:GuLoader iso

Intelligence

File Origin
# of uploads :
1
# of downloads :
40
Origin country :
CH CH
File Archive Information

This file archive contains 22 file(s), sorted by their relevance:

File name:Nongracefully.Pre
File size:448'024 bytes
SHA256 hash: 5855910a94644f5e9f286e08c2fbfe60892332b1d15c7174e98da0866eeb208e
MD5 hash: 96043b921949fb873008d19933c80feb
MIME type:text/plain
Signature GuLoader
File name:inarmed.jpg
File size:33'797 bytes
SHA256 hash: 56b9c96eb7bbbd89aab7d4a88f4bb5d6f812e8a927613533363ec945e041b110
MD5 hash: c6f8ca068f395dd94ccf9f5684ed3d2b
MIME type:image/jpeg
Signature GuLoader
File name:modstningsslutnings.pre
File size:4'582'286 bytes
SHA256 hash: 7b471f78e8a3ecbe9456378d995bedf164e5712e762f046dec09e8e9a0dcfb8c
MD5 hash: be1b4cab29864afbc06a520272fa265a
MIME type:application/octet-stream
Signature GuLoader
File name:System.dll
File size:11'264 bytes
SHA256 hash: 3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
MD5 hash: cf85183b87314359488b850f9e97a698
MIME type:application/x-dosexec
Signature GuLoader
File name:kursussgendes.ini
File size:2'755 bytes
SHA256 hash: 40e2bc57c5fe46d96781255b65349c70c48743f2c408435697a380943d0ad405
MD5 hash: 73d44d9fe658e156209a22b385d50ad3
MIME type:image/jpeg
Signature GuLoader
File name:oasean.txt
File size:34'812 bytes
SHA256 hash: ee56de39c1aa0137160e911ad2811a5d475bb88514a00fe896f4adb0daf63097
MD5 hash: e90cf0cb7d1fed32a31a510e45e61cf1
MIME type:image/jpeg
Signature GuLoader
File name:Malermestrene151.txt
File size:1'729 bytes
SHA256 hash: 229cd0b808297559e6c9425985f9dccbbda0a0d6110ff8f131a8e8d469ec7be4
MD5 hash: 757f8064442fb9d3ede8cf59d08b2e05
MIME type:image/jpeg
Signature GuLoader
File name:ned.ini
File size:35'794 bytes
SHA256 hash: 89da4d13eedf0d1128752be5993608a45d8b1d3377ce852cac6938c0514f7952
MD5 hash: 46d760ff5d80888a54a38d5bd968c3b9
MIME type:image/jpeg
Signature GuLoader
File name:dianilid.ini
File size:36'968 bytes
SHA256 hash: 5e409b92d7861a45b605be642c2ae321d67272107bb46af5451f5f40ffac9111
MD5 hash: 937845ded42e158e0a2689e744a644c4
MIME type:image/jpeg
Signature GuLoader
File name:kokassen.ini
File size:34'191 bytes
SHA256 hash: a712ca61b32808c5a568ddcd75f90ffb48e2c14320ecf56fa0ed97cc41cdae13
MD5 hash: cef032fd7be6663d613caccc3b55e8ad
MIME type:image/jpeg
Signature GuLoader
File name:SLEDZENI.BAT
File size:1'064'329 bytes
SHA256 hash: 150fd2376495248906fe73ebcb41b3d0e085f00d1a814ef9b0cae8fd211db3ee
MD5 hash: ad5493b5261351d24d035968b5040724
MIME type:application/x-dosexec
Signature GuLoader
File name:unpretendingness.ini
File size:37'391 bytes
SHA256 hash: 3f909ad51547a30d5325628c9b7a135ffcea57ebf3638b5d358d361d4b6abf0f
MD5 hash: 740280916fbeeea27bb0d31285e050f1
MIME type:image/jpeg
Signature GuLoader
File name:houser.eua
File size:6'063'327 bytes
SHA256 hash: 9710ad222541868e35201e576f9b82940fd058dda671def1694c2290202dade5
MD5 hash: 9f66ef1b27abe52dec26deebaf54050e
MIME type:application/octet-stream
Signature GuLoader
File name:Totalsaneringen242.txt
File size:36'680 bytes
SHA256 hash: 724c031992a4f4efd16f1765d956fc8b8f70e2ff0e66e521bff693c7acfec5e9
MD5 hash: ad4baf3f4d32371e93f7e0423e950480
MIME type:image/jpeg
Signature GuLoader
File name:clumper.txt
File size:1'577 bytes
SHA256 hash: 93fbe70a08e6737722b095bffcf54ddfa7a829de53c918563c29489f6cf04ec6
MD5 hash: d02aeba4ab8a0bac90aecd7ea75f71dd
MIME type:image/jpeg
Signature GuLoader
File name:Verde.att
File size:2'464'365 bytes
SHA256 hash: e2fecb9b956353c36546c6f44ca921d44781c21f0de317157491d7a397b3acec
MD5 hash: 2e37f43945d3b68f417027432096eab0
MIME type:application/octet-stream
Signature GuLoader
File name:Nsehorns.ini
File size:2'299 bytes
SHA256 hash: b8fabc110f9d67d169f84a41115d2bfa2829866a0e584bb80e18b41922f812ed
MD5 hash: b9111fe075dcec86914dbe77a269b4ac
MIME type:image/jpeg
Signature GuLoader
File name:spndetampene.txt
File size:3'204 bytes
SHA256 hash: 7d248516ebb2fdfe48310c6c191c7cb49fa1d1a5e046dd36793012df89171c47
MD5 hash: 029d885111aad24fa05433ba62a4f438
MIME type:image/jpeg
Signature GuLoader
File name:skyllemiddels.Van
File size:191'368 bytes
SHA256 hash: 94b271bed1b4f61d0f7c3d81c9f1e94592c6f211788a4801ff6313cf2bbc5088
MD5 hash: 547270bd5cd37382fbe00534c2c60538
MIME type:application/octet-stream
Signature GuLoader
File name:nutcrackers.ini
File size:35'373 bytes
SHA256 hash: cd8d35482e6a73ab18d0c231faf509531427b9b968248b32ca727714c84ce496
MD5 hash: a9da2674fe6be2898c38847de446fb1d
MIME type:image/jpeg
Signature GuLoader
File name:Flanged.jpg
File size:1'006 bytes
SHA256 hash: 46448c5ba5eac738d347757fe1ed5f3594d8056aa74adc41f635c0aebb652e45
MD5 hash: 3ea7d423eaf43b499138920ed5914c5f
MIME type:image/jpeg
Signature GuLoader
File name:Serolemma.ini
File size:341 bytes
SHA256 hash: 16d3f71cc7bd4695318968a9735642702fc184ad1fbae233630d0cafbb739c1a
MD5 hash: 559a73c0083ae01220b205cf539e0c2e
MIME type:application/x-wine-extension-ini
Signature GuLoader
Vendor Threat Intelligence
Malware configuration found for:
Archives
Details
Archives
extracted archive contents
Link:
https://research.acce.ciphertechsolutions.com/results/8b69f4b5-94ee-4a6d-8675-602ef6d7440f/
Detection(s):
Sanesecurity.Malware.30849.BadIso.cmd.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Inject5.16666.25779.9313.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a0e01c84159ce11f601e099
Tags:
n/a
Verdict:
Malicious
Labled as:
Downloader/GuLoader
Link:
https://www.hybrid-analysis.com/sample/5947bb8cb88ff7791b2ad91086d3597cc3c7dd4dae2b01fc3f9b9a183cd95dc5
Verdict:
Malicious
File Type:
iso
First seen:
2025-02-06T06:40:00Z UTC
Last seen:
2025-12-20T09:54:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/5947bb8cb88ff7791b2ad91086d3597cc3c7dd4dae2b01fc3f9b9a183cd95dc5/results?tab=lookup
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5947bb8cb88ff7791b2ad91086d3597cc3c7dd4dae2b01fc3f9b9a183cd95dc5/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2025-02-08 02:40:00 UTC
File Type:
Binary (Archive)
Extracted files:
34
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.79
Link:
https://yomi.yoroi.company/submissions/5947bb8cb88ff7791b2ad91086d3597cc3c7dd4dae2b01fc3f9b9a183cd95dc5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_SliverFox_String
Create hunting rule
Author:huoji
Description:Detect files is `SliverFox` malware
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

iso 5947bb8cb88ff7791b2ad91086d3597cc3c7dd4dae2b01fc3f9b9a183cd95dc5

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments