MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61bbc3575916717e15d80de6bb0f702c2dc93dc89c6682f358eb73fcde5dfdc9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	61bbc3575916717e15d80de6bb0f702c2dc93dc89c6682f358eb73fcde5dfdc9
SHA3-384 hash:	40c915017a696bb09a2f368651465fc1dbb493424a89f722277db08ab1163132ea80a8fe22127b91741c758b11bf2e6f
SHA1 hash:	170410c78d5bb446527fa42fc9a6246772f21807
MD5 hash:	b46a47c9c2c0657323d9385e3cb53e0c
humanhash:	autumn-solar-nevada-minnesota
File name:	New_order.rar
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	212'009 bytes
First seen:	2026-06-06 18:41:57 UTC
Last seen:	2026-06-06 18:44:33 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	6144:u03968vuRMSK4YUzk+YPrjdirB+gHXEh62PQPtVDx:uW+A6zpkhirAGXEfPQPDF
TLSH	T1052413C7D0C9D0EB9A13F2B96EF4B86107ABB5AF69558192D01CD10BF2169EC2D363C0
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	GuLoader rar

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

51

Origin country :

CH

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/81ef3d87-9e9f-4ba4-8bb5-555517971414/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Rar_fs2695.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Foxhole.Rar_fs1869.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Foxhole.Zip_fn108.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.BackDoor.Siggen2.2488.26461.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a20468257b7bf261d609c78

Tags:

injection virus sage

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

adaptive-context anti-debug evasive installer installer installer-heuristic masquerade microsoft_visual_cc nsis phishing reconnaissance signed

Link:

https://www.filescan.io/uploads/6a246a194bb6e36d180c8eb8/reports/6a24d721-e1fa-4248-ac95-749c759e767f/overview

Hybrid Analysis Mal/DrodRar

Verdict:

Suspicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/61bbc3575916717e15d80de6bb0f702c2dc93dc89c6682f358eb73fcde5dfdc9

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-06-03T20:50:00Z UTC

Last seen:

2026-06-03T21:00:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/61bbc3575916717e15d80de6bb0f702c2dc93dc89c6682f358eb73fcde5dfdc9/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/61bbc3575916717e15d80de6bb0f702c2dc93dc89c6682f358eb73fcde5dfdc9/

ReversingLabs TitaniumCloud Win32.Trojan.Kepavll

Threat name:

Win32.Trojan.Kepavll

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-04 08:23:24 UTC

File Type:

Binary (Archive)

Extracted files:

10

AV detection:

24 of 36 (66.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mg54gv2zczyx4foybxtlwd3qfqw4spoitrtif42y5nz7zxs57xeq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/61bbc3575916717e15d80de6bb0f702c2dc93dc89c6682f358eb73fcde5dfdc9