🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ade04ab33792c890649901b616bd65d4da0622063ccacd29879decb7b6270fa9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ade04ab33792c890649901b616bd65d4da0622063ccacd29879decb7b6270fa9
SHA3-384 hash: f611046f882380287693213ef4f656475b9ef93c26fc7d0878a2507645c49b8309d73e828ffccad7012312a56b069ea8
SHA1 hash: c980d520a1fa939ead91e1b9ddc03256fe2b8ba6
MD5 hash: 92d19643a8319b257a07b30116844db3
humanhash: floor-friend-vegan-lamp
File name:Zamówienie H-53 FV12112025111346347547.wsf
Download: download sample
Signature GuLoader
Create hunting rule
File size:83'801 bytes
First seen:2025-11-07 08:42:22 UTC
Last seen:Never
File type:
MIME type:text/xml
ssdeep 1536:bhz2/feCJB5SFwRmFYGmhaCfn8VL94gBpTurA8SMC2yP3pmNKApuxiwnG:pCf575SRY3EVh3BM/SMfy/p4puximG
Threatray 2'252 similar samples on MalwareBazaar
TLSH T1C8835A66DA2406160E8A27AAFC451E52E5FCC104065760EFFED90F4F610E86CF3FDA49
TrID 44.4% (.WSF) Windows Script File (8000/1/2)
27.7% (.SMI/SMIL) Synchronized Multimedia Integration Language (5001/2/2)
27.7% (.XML) Generic XML (ASCII) (5000/1)
Magika xml
Reporter Anonymous
Tags:GuLoader wsf

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
PL PL
Vendor Threat Intelligence
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690db1243afb53888cc942cf
Tags:
obfuscate xtreme spawn
Gathering data
Verdict:
Malicious
Labled as:
Trojan/VBS.GuLoader
Link:
https://www.hybrid-analysis.com/sample/ade04ab33792c890649901b616bd65d4da0622063ccacd29879decb7b6270fa9
Verdict:
Malicious
File Type:
wsf
First seen:
2025-11-07T04:59:00Z UTC
Last seen:
2025-11-08T11:20:00Z UTC
Hits:
~100
Detections:
Trojan.JS.SAgent.sb HEUR:Trojan.VBS.SAgent.gen
Link:
https://opentip.kaspersky.com/ade04ab33792c890649901b616bd65d4da0622063ccacd29879decb7b6270fa9/results?tab=lookup
Result
Threat name:
Remcos, GuLoader
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1809826
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected Remcos RAT
Early bird code injection technique detected
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Queues an APC in another process (thread injection)
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected GuLoader
Yara detected Powershell decode and execute
Yara detected Remcos RAT
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1809826 Sample: Zam#U00f3wienie H-53  FV121... Startdate: 07/11/2025 Architecture: WINDOWS Score: 100 53 wormoni.lms-austria.com 2->53 55 metavasipar.hu 2->55 57 adigo.ydns.eu 2->57 61 Suricata IDS alerts for network traffic 2->61 63 Found malware configuration 2->63 65 Malicious sample detected (through community Yara rule) 2->65 67 14 other signatures 2->67 9 powershell.exe 18 2->9         started        12 wscript.exe 1 2->12         started        14 svchost.exe 1 1 2->14         started        signatures3 process4 dnsIp5 79 Early bird code injection technique detected 9->79 81 Writes to foreign memory regions 9->81 83 Found suspicious powershell code related to unpacking or dynamic code loading 9->83 91 2 other signatures 9->91 17 msiexec.exe 6 13 9->17         started        22 conhost.exe 9->22         started        85 VBScript performs obfuscated calls to suspicious functions 12->85 87 Suspicious powershell command line found 12->87 89 Wscript starts Powershell (via cmd or directly) 12->89 93 3 other signatures 12->93 24 powershell.exe 14 18 12->24         started        59 127.0.0.1 unknown unknown 14->59 signatures6 process7 dnsIp8 49 wormoni.lms-austria.com 138.199.59.6, 49693, 49694, 52082 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR European Union 17->49 41 C:\Users\user\AppData\Local\Temp\THF702.tmp, MS-DOS 17->41 dropped 43 C:\Users\user\AppData\Local\Temp\THF6D2.tmp, MS-DOS 17->43 dropped 45 C:\Users\user\AppData\Local\Temp\THF683.tmp, PE32 17->45 dropped 47 C:\ProgramData\remcos\logs.dat, data 17->47 dropped 69 Detected Remcos RAT 17->69 71 Obfuscated command line found 17->71 73 Writes to foreign memory regions 17->73 77 4 other signatures 17->77 26 RmClient.exe 1 17->26         started        29 RmClient.exe 2 17->29         started        31 RmClient.exe 1 17->31         started        35 2 other processes 17->35 51 metavasipar.hu 79.172.252.49, 443, 49682, 49692 SZERVERNET-HU-ASHU Hungary 24->51 75 Found suspicious powershell code related to unpacking or dynamic code loading 24->75 33 conhost.exe 24->33         started        file9 signatures10 process11 signatures12 95 Tries to steal Instant Messenger accounts or passwords 26->95 97 Tries to steal Mail credentials (via file / registry access) 26->97 99 Tries to steal Mail credentials (via file registry) 29->99 101 Tries to harvest and steal browser information (history, passwords, etc) 29->101 103 Obfuscated command line found 35->103 37 conhost.exe 35->37         started        39 reg.exe 1 1 35->39         started        process13
Score:
71%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/ade04ab33792c890649901b616bd65d4da0622063ccacd29879decb7b6270fa9
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ade04ab33792c890649901b616bd65d4da0622063ccacd29879decb7b6270fa9/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/ade04ab33792c890649901b616bd65d4da0622063ccacd29879decb7b6270fa9
Threat name:
Script-WScript.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2025-11-07 07:55:30 UTC
File Type:
Text (XML)
Extracted files:
1
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vxqevmzxslejazezag3bnplf2tnamiqghtfm2kmhtxwlpnrhb6uq._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
2be5b104a63deb6addd9d49ffea10cfbefc8c214c2578f4554b6272ca3856899
GuLoader
4d69e1c88a9ca803fd7f02395dc2f3a737c32a13fe6ee801cb908fb075cd0e86
GuLoader
551863be2e92aa2d319a92cda72bc2123233ee3a7e965ee691fd70d88c21d772
GuLoader
5dfcdc1c491fbf2f7f2fbac6bbf27b84be652583b66b252c46e8ed86577c3c60
GuLoader
67fd31f9b85ca5e31e0851c8a5f8f2f36343d884aa3dd7f26d4aa6c5d02b28fe
GuLoader
71af76a68f5c3d9ca797c01373736b9d977234d30a767041c6886158be16c6a1
GuLoader
a509d90eaa00df8640c180439726fc0ed487dc30d236e19d1fc1514782e23671
GuLoader
b5d44eb79bb60df60b30f4157e958cb1a84c6ed93f2fb3767e96c573c27092e4
GuLoader
dd6d8363c2761f77948a54be192dbbe563d2da9dd8f922102547631ccbd05ebb
GuLoader
error
GuLoader
f273a1e122ed786626aa22fa45941da4f179fb7acc15a268749799f5137fa5c4
GuLoader
+ 2'242 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/251107-kmn93stkbn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Badlisted process makes network request
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ade04ab33792/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ade04ab33792c890649901b616bd65d4da0622063ccacd29879decb7b6270fa9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique
Rule name:Guloader_VBScript
Create hunting rule
Author:Ankit Anubhav - ankitanubhav.info
Description:Detects GuLoader/CloudEye VBScripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

ade04ab33792c890649901b616bd65d4da0622063ccacd29879decb7b6270fa9

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments