MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9c9dfd3bc0e86d02ccfa4c70ca85e3027e9b1b20fbe12946dc41bd4ab9e3f584. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 11
| SHA256 hash: | 9c9dfd3bc0e86d02ccfa4c70ca85e3027e9b1b20fbe12946dc41bd4ab9e3f584 |
|---|---|
| SHA3-384 hash: | 8b9ca171370b6cefd5b3c924366d673b7030b8a124ea441275f81be16bfd0ad97a4ac90eed05beb2e809206db727fac3 |
| SHA1 hash: | 69cc4dbbbf5290a116383aa16aa8d0c752e69ce5 |
| MD5 hash: | 8f8017178cf80fc33e8d9c6a122a8bac |
| humanhash: | magnesium-one-papa-failed |
| File name: | rOrderList.cmd |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 4'360 bytes |
| First seen: | 2025-09-30 10:01:18 UTC |
| Last seen: | Never |
| File type: |  cmd |
| MIME type: | text/plain |
| ssdeep | 96:UoX4BTmkQ7vn3DwDbYk9aR2agbZ4ZAkZvo8mgq4g4Cf6BfqQZq8nQ06JrE:pXOVG3y12dWfEXq1JrE |
| TLSH | T16F91416CD9525B18099C3AE61D0E0FDA031FC4B0CEE08AFBA75D624574DEAD50E7446F |
| Magika | powershell |
| Reporter |  FXOLabs |
| Tags: | cmd GuLoader |
Intelligence
File Origin
# of uploads :
1
# of downloads :
125
Origin country :
BRVendor Threat Intelligence
Verdict:
Malicious
Score:
96.5%
Tags:
phishing shell virus sage
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
base64 masquerade obfuscated powershell
Verdict:
Malicious
Labled as:
PowerShell/Agent.DIC trojan
Verdict:
Malicious
File Type:
ps1
First seen:
2025-09-30T02:53:00Z UTC
Last seen:
2025-10-02T08:23:00Z UTC
Hits:
~1000
Detections:
Trojan.PowerShell.Agent.ask HEUR:Trojan.Script.Generic BSS:Trojan.Win32.Generic
Score:
68%
Verdict:
Susipicious
File Type:
SCRIPT
Verdict:
Malicious
Threat:
Family.GULOADER
Threat name:
Win32.Trojan.Kepavll
Status:
Malicious
First seen:
2025-09-30 05:55:59 UTC
File Type:
Text (Batch)
AV detection:
8 of 38 (21.05%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
guloader
Score:
10/10
Tags:
family:guloader discovery downloader execution persistence
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Guloader family
Guloader,Cloudeye
Malware family:
Remcos
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.