🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6609e0b898a8b4db097bbf18977162cf370b81fc258c7e58dc6ece4619bb055d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6609e0b898a8b4db097bbf18977162cf370b81fc258c7e58dc6ece4619bb055d
SHA3-384 hash: fc0347d6ceeceb794178145843bf91c9e96196d2992c3e1f3be5a8e8f27e60186980e5ab83d1a79402a613ce29e626cf
SHA1 hash: 6c8b74bc10825b7a89c99f85da378634bc26b9ea
MD5 hash: 11acd9e459633a370622876835831a20
humanhash: item-north-solar-saturn
File name:scan.bat
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'321'960 bytes
First seen:2025-09-17 20:36:35 UTC
Last seen:2025-10-09 13:59:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e2a592076b17ef8bfb48b7e03965a3fc (419 x GuLoader, 63 x RemcosRAT, 52 x AgentTesla)
ssdeep 24576:q0OJTz8VwQrSMaFGxujOmUlpWeGlQL4w49iPTYEt7Pf7tJXeEoTlabDLGBCb2qmi:eCdrOFGxujoPWeGAACY6hgFhsAi
Threatray 1'805 similar samples on MalwareBazaar
TLSH T1E1553378DB20D427F6F0077810EF30B986FAE834129DE7072B686C897559ADD985E14F
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 70dcb0a4b8cc64b0 (3 x GuLoader, 2 x RemcosRAT)
Reporter threatcat_ch
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
192
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
remcos
Create hunting rule
ID:
1
File name:
scan.bat
Verdict:
Malicious activity
Analysis date:
2025-09-17 20:37:32 UTC
Tags:
remcos rat auto-reg remote
Link:
https://app.any.run/tasks/48de3b8f-585b-4760-8029-0cd29e009966

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/28006/
Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68cb1c182432032546473ce0
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file
Creating a file in the %temp% directory
Delayed reading of the file
Sending a custom TCP request
Restart of the analyzed sample
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole installer masquerade microsoft_visual_cc nsis overlay
Link:
https://www.filescan.io/uploads/68cb1c1673287948292dda3d/reports/5fa4f88c-0be3-4583-b421-1ec77cc81f9b/overview
Verdict:
Malicious
Labled as:
Malware_54.9
Link:
https://www.hybrid-analysis.com/sample/6609e0b898a8b4db097bbf18977162cf370b81fc258c7e58dc6ece4619bb055d
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-17T16:53:00Z UTC
Last seen:
2025-09-17T16:53:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/6609e0b898a8b4db097bbf18977162cf370b81fc258c7e58dc6ece4619bb055d/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/5cb6faac-39c4-417b-8b12-3c4169cfc70b
Result
Threat name:
Remcos
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1779587
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Creates autostart registry keys with suspicious names
Detected Remcos RAT
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected Remcos RAT
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1779587 Sample: scan.bat.exe Startdate: 17/09/2025 Architecture: WINDOWS Score: 100 59 geoplugin.net 2->59 61 drive.usercontent.google.com 2->61 63 drive.google.com 2->63 79 Suricata IDS alerts for network traffic 2->79 81 Found malware configuration 2->81 83 Antivirus detection for dropped file 2->83 85 7 other signatures 2->85 10 scan.bat.exe 3 47 2->10         started        14 remcos.exe 2->14         started        16 remcos.exe 1 9 2->16         started        signatures3 process4 file5 49 C:\Users\user\AppData\Local\...\System.dll, PE32 10->49 dropped 101 Tries to detect virtualization through RDTSC time measurements 10->101 103 Switches to a custom stack to bypass stack traces 10->103 105 Found direct / indirect Syscall (likely to bypass EDR) 10->105 18 scan.bat.exe 2 10 10->18         started        51 C:\Users\user\AppData\Local\...\System.dll, PE32 14->51 dropped 23 remcos.exe 14->23         started        signatures6 process7 dnsIp8 65 drive.usercontent.google.com 142.250.72.129, 443, 49722, 49725 GOOGLEUS United States 18->65 67 drive.google.com 142.250.72.174, 443, 49721, 49724 GOOGLEUS United States 18->67 43 C:\ProgramData\Remcos\remcos.exe, PE32 18->43 dropped 45 C:\ProgramData\...\remcos.exe:Zone.Identifier, ASCII 18->45 dropped 87 Detected Remcos RAT 18->87 89 Creates autostart registry keys with suspicious names 18->89 25 remcos.exe 28 18->25         started        91 Found direct / indirect Syscall (likely to bypass EDR) 23->91 file9 signatures10 process11 file12 47 C:\Users\user\AppData\Local\...\System.dll, PE32 25->47 dropped 93 Multi AV Scanner detection for dropped file 25->93 95 Found hidden mapped module (file has been removed from disk) 25->95 97 Tries to detect virtualization through RDTSC time measurements 25->97 99 2 other signatures 25->99 29 remcos.exe 4 10 25->29         started        signatures13 process14 dnsIp15 69 196.251.116.93, 2404, 49726, 49727 xneeloZA Seychelles 29->69 71 geoplugin.net 178.237.33.50, 49728, 80 ATOM86-ASATOM86NL Netherlands 29->71 53 C:\Users\user\AppData\Local\Temp\TH9EA3.tmp, MS-DOS 29->53 dropped 55 C:\Users\user\AppData\Local\Temp\TH9E06.tmp, MS-DOS 29->55 dropped 57 C:\Users\user\AppData\Local\Temp\TH9DD6.tmp, PE32 29->57 dropped 107 Detected Remcos RAT 29->107 109 Writes to foreign memory regions 29->109 111 Maps a DLL or memory area into another process 29->111 34 RmClient.exe 29->34         started        37 RmClient.exe 29->37         started        39 RmClient.exe 29->39         started        41 3 other processes 29->41 file16 signatures17 process18 signatures19 73 Tries to steal Instant Messenger accounts or passwords 34->73 75 Tries to steal Mail credentials (via file / registry access) 34->75 77 Tries to harvest and steal browser information (history, passwords, etc) 37->77
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6609e0b898a8b4db097bbf18977162cf370b81fc258c7e58dc6ece4619bb055d
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/11acd9e459633a370622876835831a20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6609e0b898a8b4db097bbf18977162cf370b81fc258c7e58dc6ece4619bb055d/
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2025-09-17 20:29:53 UTC
File Type:
PE (Exe)
Extracted files:
16
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mye6boeyvc2nwcl3x4mjo4lcz43qxap4ewgh4wg4n3hemgn3avoq._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
012cdac9c7fabd82e1be72dcacb79bd73fabdef7bd148f4f1035943e5882270b
GuLoader
293ebd610b0542289ffe9a52cab2c2a434dcff94918045a5ed1497deaee5eb87
GuLoader
5be9a105842416d225d391c67414ca7dd1f429a785edb44d76023d6bedc381ad
GuLoader
80a10c6ddb0a21c9a5c8d1495612f8b8a50c17d6d4469f04fe2f5c0e1f7b2e97
GuLoader
8806ce311854fa80261e855453c07d30b43a24d413c65cdfaae99024408bd6ff
GuLoader
af5bce0b855a401d84911a6e5f59de62aa695faf1102e8dc0658268e3635d5f7
GuLoader
b4d2e40296ddd8f6127f9d2ba3703b134fee350602ee9c90f6d73737a2186a86
GuLoader
error
GuLoader
f9bc3826335bcf6a03da3b8743c2bdcbc7747962786a83c90fd2b1d3c8b85353
GuLoader
+ 1'795 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:remcos discovery downloader persistence rat
Link:
https://tria.ge/reports/250917-zefqaswvbx/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Guloader family
Guloader,Cloudeye
Remcos
Remcos family
Malware Config
C2 Extraction:
196.251.116.93:2404
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/fa6042fb-2686-4293-a095-2dcfee8fb799
Unpacked files
SH256 hash:
6609e0b898a8b4db097bbf18977162cf370b81fc258c7e58dc6ece4619bb055d
MD5 hash:
11acd9e459633a370622876835831a20
SHA1 hash:
6c8b74bc10825b7a89c99f85da378634bc26b9ea
Link:
https://www.unpac.me/results/dc2e05b7-d9d3-4108-8289-5dfc0eb06f51/
SH256 hash:
2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
MD5 hash:
a4dd044bcd94e9b3370ccf095b31f896
SHA1 hash:
17c78201323ab2095bc53184aa8267c9187d5173
Link:
https://www.unpac.me/results/dc2e05b7-d9d3-4108-8289-5dfc0eb06f51/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6609e0b898a8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6609e0b898a8b4db097bbf18977162cf370b81fc258c7e58dc6ece4619bb055d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 6609e0b898a8b4db097bbf18977162cf370b81fc258c7e58dc6ece4619bb055d

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/28006/

Comments