🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78e6e35c2a458be47941212011f2108bcc1d867d48633a03cd34d7faca01bf46. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78e6e35c2a458be47941212011f2108bcc1d867d48633a03cd34d7faca01bf46
SHA3-384 hash: 1e8350ca4635661a73b3ed6f8a10667bb1d9e6c3ac70e9b0cc0b2212152cb48dfe2a8dbb55d3a1919dfa2ee06cfaf93f
SHA1 hash: 4dc60138f7ac7cb9fd71c3eb9c7f641f87ed0f68
MD5 hash: 6671c8c7359d1d3ed63e6a00aca38f4f
humanhash: carolina-failed-east-undress
File name:Contract_Documents,_Payment_Receipts,_and_Outstanding_Invoice.ace
Download: download sample
Signature GuLoader
Create hunting rule
File size:1'212'105 bytes
First seen:2026-04-13 16:39:14 UTC
Last seen:2026-05-20 16:46:32 UTC
File type: ace
MIME type:application/x-ace-compressed
ssdeep 24576:+PWnh3ZdW6BqbdftMRrwbUkvuxBIKkoCCPYWiM5463UHeOyfjiyDnlB:oW97WdbdftMg7QIKkGD/OAtOyfJB
TLSH T14E453309B9D727F26C3580673EA6F3B3D52A6E1711FB80171E615DCF4A60A17F882263
Magika ace
Reporter TomU
Tags:ace GuLoader


Avatar
TomU
--- mail attachments (spaces replaced with [_X]) ---
6671c8c7359d1d3ed63e6a00aca38f4f Contract_Documents,_Payment_Receipts,_and_Outstanding_Invoice.ace
595142b735b84c9213663acc54581125 Contract_Documents,_Payment_Receipts,_and_Outstanding_Invoice.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
53
Origin country :
CH CH
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69dd1c4945787c53e5395760
Tags:
n/a
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
fareit pony
Link:
https://www.filescan.io/uploads/69dd1c445ea31bc68a26b806/reports/1122955b-53ef-4df4-8f78-b490adf269a8/overview
Verdict:
Malicious
Labled as:
Mal/DrodAce
Link:
https://www.hybrid-analysis.com/sample/78e6e35c2a458be47941212011f2108bcc1d867d48633a03cd34d7faca01bf46
Verdict:
Malicious
File Type:
ace
First seen:
2026-04-13T05:58:00Z UTC
Last seen:
2026-04-15T13:49:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/78e6e35c2a458be47941212011f2108bcc1d867d48633a03cd34d7faca01bf46/results?tab=lookup
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/78e6e35c2a458be47941212011f2108bcc1d867d48633a03cd34d7faca01bf46/
Verdict:
Malicious
Threat:
Family.GULOADER
Link:
https://tip.neiki.dev/file/78e6e35c2a458be47941212011f2108bcc1d867d48633a03cd34d7faca01bf46
Threat name:
Win32.Trojan.Kepavll
Create hunting rule
Status:
Malicious
First seen:
2026-04-13 13:09:36 UTC
File Type:
Binary (Archive)
Extracted files:
22
AV detection:
12 of 23 (52.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pdtogxbkiwf6i6kbeeqbd4qqrpgb3bt5jbrtua6ngtl7vsqbx5da._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/78e6e35c2a458be47941212011f2108bcc1d867d48633a03cd34d7faca01bf46

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ACE_Containing_EXE
Create hunting rule
Author:Florian Roth (Nextron Systems) - based on Nick Hoffman' rule - Morphick Inc
Description:Looks for ACE Archives containing an exe/scr file

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

ace 78e6e35c2a458be47941212011f2108bcc1d867d48633a03cd34d7faca01bf46

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments


Avatar
TomU @c_APT_ure commented on 2026-04-13 17:00:35 UTC

https://tria.ge/reports/260413-t6v2eafz3t/
Family: MassLogger
Malware Config
C2 Extraction:
hXXps://api.telegram[.]org/bot8746661842:AAE8AgLY2iaMqbGfy0FikzJUGAh9bpH8cT0/sendMessage?chat_id=7968948391