MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9887e744567fdd5c27954bee4dbfc568bcee5eead952b37c02ddd850247dfaeb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9887e744567fdd5c27954bee4dbfc568bcee5eead952b37c02ddd850247dfaeb
SHA3-384 hash:	47dee4d65d3052802d9bdaa34f90df57f88eec2a9989a67b173a6f48d11746d36411edb19c2c9d03bb75072b6afbed27
SHA1 hash:	7d2c4be269584c6636f486bf1f4cf69fe91f7133
MD5 hash:	04ac80a92482df743a60d647b3abeff7
humanhash:	berlin-fix-ohio-carbon
File name:	PKO_Bank,pdf.cmd
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	4'344 bytes
First seen:	2025-09-18 13:05:07 UTC
Last seen:	Never
File type:	cmd
MIME type:	text/plain
ssdeep	96:TLC8HnTicWWOE0stBBwdV0NJofGVHBOwawT4B4:iErWWTJ6dVqJoiUgc4
TLSH	T169910ED9AF866B5C0784BED3204FE8338A1736E83F6250665AFD80E5BE0477014F9A56
Magika	powershell
Reporter	Anonymous
Tags:	cmd GuLoader

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

132

Origin country :

PL

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68cc03be6b621794b13099c6

Tags:

xtreme shell sage

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

base64 obfuscated powershell

Link:

https://www.filescan.io/uploads/68cc03bd390649f7a5f2c964/reports/6b100eb7-94c5-4e47-b0bc-bac568881051/overview

Hybrid Analysis BAT/Agent.BDZ

Verdict:

Suspicious

Labled as:

BAT/Agent.BDZ

Link:

https://www.hybrid-analysis.com/sample/9887e744567fdd5c27954bee4dbfc568bcee5eead952b37c02ddd850247dfaeb

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2025-09-18T09:10:00Z UTC

Last seen:

2025-09-18T09:10:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/9887e744567fdd5c27954bee4dbfc568bcee5eead952b37c02ddd850247dfaeb/results?tab=lookup

Joe Sandbox GuLoader

Result

Threat name:

GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1780041

Signature

Early bird code injection technique detected

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Obfuscated command line found

Queues an APC in another process (thread injection)

Sigma detected: Potential PowerShell Command Line Obfuscation

Suspicious powershell command line found

Writes to foreign memory regions

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

91%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/9887e744567fdd5c27954bee4dbfc568bcee5eead952b37c02ddd850247dfaeb

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9887e744567fdd5c27954bee4dbfc568bcee5eead952b37c02ddd850247dfaeb/

Neiki Family.REMCOS

Verdict:

Malicious

Threat:

Family.REMCOS

Link:

https://tip.neiki.dev/file/9887e744567fdd5c27954bee4dbfc568bcee5eead952b37c02ddd850247dfaeb

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.GuLoader

Threat name:

Script-PowerShell.Trojan.GuLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-09-18 13:06:01 UTC

File Type:

Text

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tcd6orcwp7ovyj4vjpxe3p6fnc6o4xxk3fjlg7ac3xmfajd57lvq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/250918-qb13dsgm3x/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/9887e744567fdd5c27954bee4dbfc568bcee5eead952b37c02ddd850247dfaeb