MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3d67ef808497bf48930be418667da0c2d815431213ff9ca4304be6669f26801. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	a3d67ef808497bf48930be418667da0c2d815431213ff9ca4304be6669f26801
SHA3-384 hash:	00b3f1f4c337f548d96919ccd378b927b6051bc3c055245907620df451553522459b288c99fd27d9acaf671f8d1f240a
SHA1 hash:	1eee672644375e37ea708a8417d0ab3128826211
MD5 hash:	b4691ff531364fd7ef388299ec6c8b59
humanhash:	eleven-kilo-two-july
File name:	Bexitor Installer.exe
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	279'588 bytes
First seen:	2025-11-21 09:04:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3abe302b6d9a1256e6a915429af4ffd2 (271 x GuLoader, 38 x Formbook, 25 x Loki)
ssdeep	6144:T7e/FDS+SjYV8PNoM3q0oQxbfOqNenyw0lO+p:fYSRjYV0NzoSOqQyw0l1p
TLSH	T18D547B416F38D8A2CA505172C826E6F63DA61D84ABE4DE972BC23F9F77351E1057E00B
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	juroots
Tags:	exe GuLoader

Intelligence

File Origin

# of uploads :

# of downloads :

111

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Bexitor Installer.exe

Verdict:

No threats detected

Analysis date:

2025-11-21 09:31:54 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/f1bc5af6-dafc-40a8-98b0-091e6c7638d1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/38921/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL

SecuriteInfo.com.Troj.Inject-EAO.957.UNOFFICIAL

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69202b7d8cf6736ec0aff901

Tags:

infosteal autorun

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% subdirectories

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug blackhole fingerprint installer installer installer-heuristic microsoft_visual_cc nsis overlay

Link:

https://www.filescan.io/uploads/69202bec6a9db4642e0e3f83/reports/87c282ed-02a5-4531-acd0-2f3dc13ab3cd/overview

Verdict:

Malicious

Labled as:

TrojanRansom.Foreign.oecl

Link:

https://www.hybrid-analysis.com/sample/a3d67ef808497bf48930be418667da0c2d815431213ff9ca4304be6669f26801

Verdict:

Clean

File Type:

exe x32

First seen:

2025-11-21T06:18:00Z UTC

Last seen:

2025-11-21T06:31:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a3d67ef808497bf48930be418667da0c2d815431213ff9ca4304be6669f26801/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/32da21b4-71b5-4343-9379-2f8173682a08

Score:

57%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/a3d67ef808497bf48930be418667da0c2d815431213ff9ca4304be6669f26801

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/b4691ff531364fd7ef388299ec6c8b59

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a3d67ef808497bf48930be418667da0c2d815431213ff9ca4304be6669f26801/

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/a3d67ef808497bf48930be418667da0c2d815431213ff9ca4304be6669f26801

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uplh56aijf57jcjqxzaymz62bqwycvbree77tssdas7gm2psnaaq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery installer

Link:

https://tria.ge/reports/251121-k2pjdsskhs/

Behaviour

Modifies registry class

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/4d8bc50d-fcee-4e97-af6d-1520643957c1

Unpacked files

SH256 hash:

a3d67ef808497bf48930be418667da0c2d815431213ff9ca4304be6669f26801

MD5 hash:

b4691ff531364fd7ef388299ec6c8b59

SHA1 hash:

1eee672644375e37ea708a8417d0ab3128826211

Link:

https://www.unpac.me/results/ea3223e1-1085-4488-81eb-5d4e7412db70/

SH256 hash:

ae52885d33b04417a72126e604985693025745c381374dc4053439f9b2c3b37a

MD5 hash:

1d4640e3109e5fadd886aba8c187aec1

SHA1 hash:

b7faa784d43b024930a33367c15b866ecb1445e7

Link:

https://www.unpac.me/results/ea3223e1-1085-4488-81eb-5d4e7412db70/

SH256 hash:

6222d1c5274290643af093f3b61610d40bd8da4d4dba4f55ff28ae524e6cc02f

MD5 hash:

fdaec83d9f6ba1818b537a31d776b108

SHA1 hash:

c3ece5727cc76343df3cc020cb1f29b080e1ed83

Link:

https://www.unpac.me/results/ea3223e1-1085-4488-81eb-5d4e7412db70/

SH256 hash:

a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

MD5 hash:

fbe295e5a1acfbd0a6271898f885fe6a

SHA1 hash:

d6d205922e61635472efb13c2bb92c9ac6cb96da

Link:

https://www.unpac.me/results/ea3223e1-1085-4488-81eb-5d4e7412db70/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a3d67ef808497bf48930be418667da0c2d815431213ff9ca4304be6669f26801

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.