🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aba5cbb2ccd28f4b6ff7560dd3e30ef803cb5068c28a962ad32e3a011850d3e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 18


Intelligence 18 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aba5cbb2ccd28f4b6ff7560dd3e30ef803cb5068c28a962ad32e3a011850d3e2
SHA3-384 hash: 6ed95ac499ead223bceed447511c0319d3f02799c2ed6ec117e9cd143fdf0aeb0f69e9d8a2bb9f2f4567d7da53df686b
SHA1 hash: 31333b9ec43dbb132e5806c6003383c465ab67c8
MD5 hash: ba830e58388900f50bf27e6b6c0fbd0c
humanhash: pasta-angel-alpha-salami
File name:scan.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:504'226 bytes
First seen:2026-03-24 22:41:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1f23f452093b5c1ff091a2f9fb4fa3e9 (303 x GuLoader, 47 x AgentTesla, 47 x RemcosRAT)
ssdeep 6144:Zp+ggNsm8fQErfR76M90vdnTwQ3K7ZC6F6s0fLQpSQdCISDRMDQsplhrA6:PjmcrrxB05kQAC6Is0cSQAdMDR
Threatray 4'433 similar samples on MalwareBazaar
TLSH T16FB4020137519265C6B4CBB090D9E3F3DB6C651E3D62AA377B40DECBBA6D1DDA022324
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon d89afaf6f6faeae8 (3 x RemcosRAT, 2 x GuLoader)
Reporter threatcat_ch
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
1
# of downloads :
176
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
GuLoader NSIS
Details
GuLoader
an XOR decryption key and an extracted component
GuLoader
a c2 URL, a useragent string, and a string XOR key
NSIS
extracted archive contents
Link:
https://research.acce.ciphertechsolutions.com/results/65a87080-2985-40a5-a166-d1a5a9597129/
Malware family:
remcos
Create hunting rule
ID:
1
File name:
_aba5cbb2ccd28f4b6ff7560dd3e30ef803cb5068c28a962ad32e3a011850d3e2.exe
Verdict:
Malicious activity
Analysis date:
2026-03-24 22:42:40 UTC
Tags:
remcos rat auto-reg
Link:
https://app.any.run/tasks/ff72182f-b26f-41cc-81ae-93491fa7e81f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Guloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/59096/
Detection(s):
SecuriteInfo.com.Trojan.Inject6.17752.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69c31350390b996474136f70
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Searching for the window
Creating a file
Delayed reading of the file
DNS request
Unauthorized injection to a recently created process
Restart of the analyzed sample
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole fingerprint installer installer installer-heuristic microsoft_visual_cc nsis soft-404
Link:
https://www.filescan.io/uploads/69c3134d256cd88a6aaf2cb4/reports/05bcd31f-4453-433c-acdf-c02c40e2fb57/overview
Verdict:
Suspicious
Labled as:
Malware_
Link:
https://www.hybrid-analysis.com/sample/aba5cbb2ccd28f4b6ff7560dd3e30ef803cb5068c28a962ad32e3a011850d3e2
Verdict:
Malicious
File Type:
exe x32
Detections:
Trojan.NSIS.Makoob.sba Backdoor.Win32.Remcos.sb PDM:Trojan.Win32.Generic Trojan-Dropper.Win32.Injector.sb Trojan-Downloader.Win32.Minix.sb Trojan.Win32.Guloader.sb HEUR:Trojan-Downloader.Win32.Minix.gen
Link:
https://opentip.kaspersky.com/aba5cbb2ccd28f4b6ff7560dd3e30ef803cb5068c28a962ad32e3a011850d3e2/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/b98c5c08-7d0f-4274-8b92-69c6142e2cc8
Result
Threat name:
Remcos, GuLoader
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1888581
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Creates autostart registry keys with suspicious names
Detected Remcos RAT
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected GuLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1888581 Sample: scan.exe Startdate: 24/03/2026 Architecture: WINDOWS Score: 100 69 drive.usercontent.google.com 2->69 71 drive.google.com 2->71 81 Suricata IDS alerts for network traffic 2->81 83 Found malware configuration 2->83 85 Antivirus detection for dropped file 2->85 87 7 other signatures 2->87 10 scan.exe 5 43 2->10         started        14 remcos.exe 27 2->14         started        16 remcos.exe 8 2->16         started        signatures3 process4 file5 63 C:\Users\user\AppData\Local\...\System.dll, PE32 10->63 dropped 99 Tries to detect virtualization through RDTSC time measurements 10->99 101 Unusual module load detection (module proxying) 10->101 103 Switches to a custom stack to bypass stack traces 10->103 18 scan.exe 2 10 10->18         started        23 scan.exe 10->23         started        65 C:\Users\user\AppData\Local\...\System.dll, PE32 14->65 dropped 25 remcos.exe 14->25         started        27 remcos.exe 14->27         started        signatures6 process7 dnsIp8 73 drive.google.com 142.251.218.14, 443, 49722, 49726 GOOGLEUS United States 18->73 75 drive.usercontent.google.com 142.251.41.1, 443, 49723, 49727 GOOGLEUS United States 18->75 53 C:\ProgramData\Remcos\remcos.exe, PE32 18->53 dropped 55 C:\ProgramData\...\remcos.exe:Zone.Identifier, ASCII 18->55 dropped 89 Detected Remcos RAT 18->89 91 Creates autostart registry keys with suspicious names 18->91 29 remcos.exe 27 18->29         started        33 scan.exe 18->33         started        77 142.251.34.65, 443, 49731 GOOGLEUS United States 25->77 35 remcos.exe 25->35         started        file9 signatures10 process11 file12 67 C:\Users\user\AppData\Local\...\System.dll, PE32 29->67 dropped 115 Found hidden mapped module (file has been removed from disk) 29->115 117 Tries to detect virtualization through RDTSC time measurements 29->117 119 Unusual module load detection (module proxying) 29->119 121 Switches to a custom stack to bypass stack traces 29->121 37 remcos.exe 4 10 29->37         started        42 remcos.exe 29->42         started        signatures13 process14 dnsIp15 79 130.12.181.39, 2404, 49728, 49729 DATAHOPDatahop-SixDegreesGB Canada 37->79 57 C:\Users\user\AppData\Local\Temp\TH48CC.tmp, MS-DOS 37->57 dropped 59 C:\Users\user\AppData\Local\Temp\TH489C.tmp, MS-DOS 37->59 dropped 61 C:\Users\user\AppData\Local\Temp\TH487C.tmp, MS-DOS 37->61 dropped 93 Detected Remcos RAT 37->93 95 Writes to foreign memory regions 37->95 97 Maps a DLL or memory area into another process 37->97 44 userinit.exe 37->44         started        47 userinit.exe 37->47         started        49 userinit.exe 37->49         started        51 2 other processes 37->51 file16 signatures17 process18 signatures19 105 Tries to steal Mail credentials (via file registry) 44->105 107 Tries to harvest and steal browser information (history, passwords, etc) 44->107 109 Unusual module load detection (module proxying) 44->109 111 Tries to steal Instant Messenger accounts or passwords 47->111 113 Tries to steal Mail credentials (via file / registry access) 47->113
Score:
70%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/aba5cbb2ccd28f4b6ff7560dd3e30ef803cb5068c28a962ad32e3a011850d3e2
Gathering data
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/aba5cbb2ccd28f4b6ff7560dd3e30ef803cb5068c28a962ad32e3a011850d3e2/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/aba5cbb2ccd28f4b6ff7560dd3e30ef803cb5068c28a962ad32e3a011850d3e2
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2026-03-24 22:42:28 UTC
File Type:
PE (Exe)
Extracted files:
13
AV detection:
16 of 23 (69.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vos4xmwm2khuw37xkyg5hyyo7ab4wudiykfjmkwtfy5acgcq2pra._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
0cb6636748ff6a60ebf1a4644a7b4c877f8a19edd8c7a2eac10b34d1bd7cbfbf
GuLoader
199bd66bf9f7b299ebf9068feb2e8648404097e26f86cabc5462973769d24df5
GuLoader
238864be2d731bc5838b95c8bb50b961d19f04b6b64d3daf323db967266fa458
GuLoader
29032ae14e315863a55a0851c3e1c9cb246beb4513a279d8b1bf7fac97be6ff7
GuLoader
482f10e5f1825368c6cdacf482febf39ed6d035ce866aded813d18890cf86dca
GuLoader
79866667d5cd578a1c6eda54a748ff9d316fff39064eecd282bc2a9ad8a5ac7d
GuLoader
8eaffa403a0bacae0e43928c07f77ea8540b480eda49e10d4a44079b8e0236fe
GuLoader
c92b8de7afab714c39ef49e954887a849f7e0e73c1e916ca20c5db06477551af
GuLoader
ea3c63e01dc18acb8940dbbe5bec6c3cdcb6c117b6a213b9e7e02c11caeabee0
GuLoader
error
GuLoader
f2a42302b9c4f3e6c1e2e5d15dfa09cb41aad80ebc13678c4a412f77d4141ca0
GuLoader
+ 4'423 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost collection discovery persistence rat
Link:
https://tria.ge/reports/260324-2mtm8sgv2v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook accounts
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Detected Nirsoft tools
Remcos
Remcos family
Malware Config
C2 Extraction:
130.12.181.39:2404
Unpacked files
SH256 hash:
aba5cbb2ccd28f4b6ff7560dd3e30ef803cb5068c28a962ad32e3a011850d3e2
MD5 hash:
ba830e58388900f50bf27e6b6c0fbd0c
SHA1 hash:
31333b9ec43dbb132e5806c6003383c465ab67c8
Link:
https://www.unpac.me/results/3e4ec139-bc40-4f68-aff6-238bc5ef694b/
SH256 hash:
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
MD5 hash:
75ed96254fbf894e42058062b4b4f0d1
SHA1 hash:
996503f1383b49021eb3427bc28d13b5bbd11977
Link:
https://www.unpac.me/results/3e4ec139-bc40-4f68-aff6-238bc5ef694b/
Malware family:
Remcos
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/aba5cbb2ccd2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.79
Link:
https://yomi.yoroi.company/submissions/aba5cbb2ccd28f4b6ff7560dd3e30ef803cb5068c28a962ad32e3a011850d3e2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe aba5cbb2ccd28f4b6ff7560dd3e30ef803cb5068c28a962ad32e3a011850d3e2

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/59096/

Comments