🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545
SHA3-384 hash: 6a2368b1f5e5d151a060cb67a12ad69738761c8c1aa8d5452e5b9f34fb3d4e3ac3c4c7782ae976ddd7f9f13aca56b5f5
SHA1 hash: f3ef3854aa7f344c46587b63c93c97d4bf63b9e5
MD5 hash: 4b27440dc8cb57d6b77632e6520af4c1
humanhash: high-pluto-queen-robert
File name:PO BCF2026.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:965'053 bytes
First seen:2026-06-18 05:54:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 46ce5c12b293febbeb513b196aa7f843 (47 x GuLoader, 21 x RemcosRAT, 15 x AgentTesla)
ssdeep 24576:tn3ClvMI4qfv4Qv3K5ItTpT3KfSa2o1HOWfVvc:t3Cxhfv4Qv3qIzrKfz2o1uW90
Threatray 2'610 similar samples on MalwareBazaar
TLSH T1EA250181AA50C176D9A602B0DBEBFDF41167BC1FF8A1194B3AE1BEDA3D72160441718F
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 3178ccccccccccd4 (4 x GuLoader)
Reporter lowmal3
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
222
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
GuLoader NSIS
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f0d1e384-a6ce-485b-9937-98d65eec3c49/
Malware family:
formbook
Create hunting rule
ID:
1
File name:
_5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545.exe
Verdict:
Malicious activity
Analysis date:
2026-06-18 05:56:42 UTC
Tags:
formbook xloader
Link:
https://app.any.run/tasks/ef21c7a6-3142-48c7-8c1e-33d323f6f63e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/71123/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.80570465.9613.14752.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a33882954a045c3408a15ee
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Searching for the window
Creating a file in the %AppData% subdirectories
Creating a file
Unauthorized injection to a recently created process
Restart of the analyzed sample
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug evasive installer installer installer-heuristic microsoft_visual_cc nsis reconnaissance
Link:
https://www.filescan.io/uploads/6a33882362d0679105f75083/reports/ca5982f7-f456-42d3-aed2-ec64da249d0a/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-06-17T07:10:00Z UTC
Last seen:
2026-06-20T00:50:00Z UTC
Hits:
~1000
Detections:
Trojan-Downloader.Win32.Minix.cwe Trojan.Win32.Guloader.sb Trojan.NSIS.Makoob.sba Trojan-Downloader.Win32.Minix.sb
Link:
https://opentip.kaspersky.com/5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/91c665a5-1395-42bc-aceb-68bc0160d705
Result
Threat name:
FormBook, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1929744
Signature
Antivirus detection for URL or domain
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queries Google from non browser process on port 80
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Yara detected FormBook
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1929744 Sample: PO BCF2026.exe Startdate: 18/06/2026 Architecture: WINDOWS Score: 100 38 www.mobilik.xyz 2->38 40 www.darkriver.xyz 2->40 42 15 other IPs or domains 2->42 54 Suricata IDS alerts for network traffic 2->54 56 Antivirus detection for URL or domain 2->56 58 Multi AV Scanner detection for submitted file 2->58 62 6 other signatures 2->62 11 PO BCF2026.exe 1 42 2->11         started        signatures3 60 Performs DNS queries to domains with low reputation 40->60 process4 file5 36 C:\Users\user\AppData\Local\...\System.dll, PE32 11->36 dropped 14 PO BCF2026.exe 6 11->14         started        18 PO BCF2026.exe 11->18         started        process6 dnsIp7 50 drive.google.com 142.251.40.110, 443, 49696 GOOGLE-GoogleLLCUS United States 14->50 52 drive.usercontent.google.com 142.251.40.97, 443, 49697 GOOGLE-GoogleLLCUS United States 14->52 72 Maps a DLL or memory area into another process 14->72 20 WrVNPcNY4.exe 14->20 injected 22 PO BCF2026.exe 14->22         started        signatures8 process9 process10 24 write.exe 13 20->24         started        signatures11 64 Tries to steal Mail credentials (via file / registry access) 24->64 66 Tries to harvest and steal browser information (history, passwords, etc) 24->66 68 Modifies the context of a thread in another process (thread injection) 24->68 70 4 other signatures 24->70 27 dhrFBtCuA7N.exe 24->27 injected 30 chrome.exe 24->30         started        32 firefox.exe 24->32         started        process12 dnsIp13 44 www.darkriver.xyz 162.0.213.215, 49717, 49718, 49719 NAMECHEAP-NET-NamecheapIncUS United States 27->44 46 www.cuacaacehutara.org 192.64.119.11, 49733, 49734, 80 NAMECHEAP-NET-NamecheapIncUS United States 27->46 48 8 other IPs or domains 27->48 34 WerFault.exe 4 30->34         started        process14
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545/
Verdict:
Malicious
Threat:
Family.FORMBOOK
Link:
https://tip.neiki.dev/file/5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545
Threat name:
Win32.Trojan.Sonbokli
Create hunting rule
Status:
Malicious
First seen:
2026-06-17 10:05:57 UTC
AV detection:
7 of 38 (18.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l2o3luzrlnanfemn4b6c55x3ciubexjaagkovduipfevvtyh2vcq._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
28b74e0919f0e8f08ca698f7d4c897ce345f0ad1f2752e29450d0ef4fe1eaeff
GuLoader
356fff64ff9df80d01dcaa27e448ef80e28767a80f82d03bede6062db9f21156
GuLoader
361436a35e227ad65a1fbebd6f76e8b970334ae5c89996fd85d1f7cfa69eb0fc
GuLoader
3d598d95b0c985d9a1e2fd399f00ebfc5177539b9e0c814ae12abadfc4933e0c
GuLoader
56316afa7cc9642c064f64f1572f8e0c6a70f207f31229609670a6c4515624ca
GuLoader
5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545
GuLoader
7fed823191f3c1381f63d43e74dee66f451c6cc6bcb1cf753996e13aaec7921d
GuLoader
9abc8e3fc8f7ae42dbea952c3cb51b74bd1980ffaddb36b590a66162305bf3aa
GuLoader
b2c09f242ce0a6b8fe0a1a889d866d72cace7d83ea71765372215cc0eb85ffa6
GuLoader
error
GuLoader
+ 2'600 additional samples on MalwareBazaar
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader discovery downloader
Link:
https://tria.ge/reports/260618-gl9ylse19l/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Contacts third-party web service commonly abused for C2
Loads dropped DLL
Family: Guloader,Cloudeye
Unpacked files
SH256 hash:
5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545
MD5 hash:
4b27440dc8cb57d6b77632e6520af4c1
SHA1 hash:
f3ef3854aa7f344c46587b63c93c97d4bf63b9e5
Link:
https://www.unpac.me/results/2e403a4c-dfd8-4a32-a5f6-0af11fc91415/
SH256 hash:
996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 hash:
6d08f0d5503bb100b8429fefaad163a6
SHA1 hash:
2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
Link:
https://www.unpac.me/results/2e403a4c-dfd8-4a32-a5f6-0af11fc91415/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5e9db5d3315b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 5e9db5d3315b40d2918de07c2ef6fb1228125d200194ea8e8879495acf07d545

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/71123/

Comments