MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81850fd796e155b48ca148b0938af3a2bd36181ee7043ff11b9e6b186ae2dfe2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81850fd796e155b48ca148b0938af3a2bd36181ee7043ff11b9e6b186ae2dfe2
SHA3-384 hash: 2c3e111b7042496fca19f5523b5799cefaca295b108b37a8e7141b31c705bd6617b60307e3a0676a5dd3f3ce9c260229
SHA1 hash: dca3709b9f13ae94e072700b72af4c0c43b35238
MD5 hash: 25b88362ca18c877ffb38e3d711ae479
humanhash: florida-nitrogen-nuts-fifteen
File name:81850fd796e155b48ca148b0938af3a2bd36181ee7043ff11b9e6b186ae2dfe2
Download: download sample
File size:176'623 bytes
First seen:2026-08-10 14:35:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e221f4f7d36469d53810a4b5f9fc8966 (118 x GuLoader, 28 x RemcosRAT, 21 x Formbook)
ssdeep 3072:1LfVxlyEZfp9zIb45zUT+T9B6nGhtGh0zXBlKZiu8ow6zudPM+ku1:ltXZXcMjKGDLXy8uUwu1
TLSH T15904020977C0C07AC69396300EB6CBFAE673E76406291B3B2744AF6D7E702C1DA09795
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon c4dadadad2f492c2 (148 x GuLoader, 51 x RemcosRAT, 23 x VIPKeylogger)
Reporter adrian__luca
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
41
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
GuLoader NSIS
Details
Link:
https://research.acce.ciphertechsolutions.com/results/51742739-a72e-4eea-9cad-340126bf94c5/
Malware family:
n/a
ID:
1
File name:
Прошу оплатить вложенный счет на поверку счетчика_ 2109251046.bat
Verdict:
Suspicious activity
Analysis date:
2026-07-20 12:09:56 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/16ed5d06-339a-461e-8973-58d3333310b3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Searching for the window
Creating a file
Delayed reading of the file
Launching a service
Changing a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug base64 base64 installer installer installer-heuristic microsoft_visual_cc nsis reconnaissance
Link:
https://www.filescan.io/uploads/6a79e208c28463a7097ae37e/reports/012d8395-ea2f-4c51-9ece-e7f31555b4ed/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/81850fd796e155b48ca148b0938af3a2bd36181ee7043ff11b9e6b186ae2dfe2
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-20T02:16:00Z UTC
Last seen:
2026-08-10T10:44:00Z UTC
Hits:
~10000
Link:
https://opentip.kaspersky.com/81850fd796e155b48ca148b0938af3a2bd36181ee7043ff11b9e6b186ae2dfe2/results?tab=lookup
Gathering data
Score:
93%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/81850fd796e155b48ca148b0938af3a2bd36181ee7043ff11b9e6b186ae2dfe2
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/81850fd796e155b48ca148b0938af3a2bd36181ee7043ff11b9e6b186ae2dfe2/
Threat name:
Win32.Trojan.Runner
Create hunting rule
Status:
Suspicious
First seen:
2026-07-20 05:17:57 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qgcq7v4w4fk3jdfbjcyjhcxtuk6tmga644cd74i3tzvrq2xc37ra._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/260810-r5myas1cqg/
Behaviour
Suspicious use of AdjustPrivilegeToken
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks QEMU agent file
Loads dropped DLL
Unpacked files
SH256 hash:
81850fd796e155b48ca148b0938af3a2bd36181ee7043ff11b9e6b186ae2dfe2
MD5 hash:
25b88362ca18c877ffb38e3d711ae479
SHA1 hash:
dca3709b9f13ae94e072700b72af4c0c43b35238
Link:
https://www.unpac.me/results/05983db2-402d-44ef-b954-4bae0c318c9d/
SH256 hash:
5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
MD5 hash:
7399323923e3946fe9140132ac388132
SHA1 hash:
728257d06c452449b1241769b459f091aabcffc5
Link:
https://www.unpac.me/results/05983db2-402d-44ef-b954-4bae0c318c9d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.99
Link:
https://yomi.yoroi.company/submissions/81850fd796e155b48ca148b0938af3a2bd36181ee7043ff11b9e6b186ae2dfe2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:NSIS
Create hunting rule
Author:kevoreilly
Description:NSIS Integrity Check function
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/79933/

Comments