🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b24d9b4fe10dec89c3585169731a20a070b4646e7e0c72bdaa550bc5969b306c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 18


Intelligence 18 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b24d9b4fe10dec89c3585169731a20a070b4646e7e0c72bdaa550bc5969b306c
SHA3-384 hash: 680465e89a0cc6f8441cc8c26461fbdc52d8933aa926d6940dc97bd1b2ca06fb85bbe6e0b898878b3db2c16af47d568c
SHA1 hash: d8c8be746f58d0f07ad0a22bfa391af6075a5557
MD5 hash: 27a6a80adc174c46a9babcad794da0b9
humanhash: ohio-florida-kitten-hydrogen
File name:27a6a80adc174c46a9babcad794da0b9.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:426'236 bytes
First seen:2026-06-15 15:51:16 UTC
Last seen:2026-06-29 08:23:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 56a78d55f3f7af51443e58e0ce2fb5f6 (741 x GuLoader, 453 x Formbook, 295 x Loki)
ssdeep 6144:ZbE/HUttFJRHSDqGIgQCWejB/fb/ALWjft4XbF6zs3d7R36E5kFKdND0SE:ZbRtFJRuqCWmVoyjftC4Md7B6ckiD7E
Threatray 2'432 similar samples on MalwareBazaar
TLSH T19394F120759DE4A2FCD1643B6836C2775BB8BC2E7E646E433AD07B2F39720D5901A742
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 0c70644460f8f83c (1 x GuLoader)
Reporter abuse_ch
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
3
# of downloads :
237
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
GuLoader NSIS
Details
Link:
https://research.acce.ciphertechsolutions.com/results/97e0ca42-890e-4020-956f-c02c4042693e/
Malware family:
remcos
Create hunting rule
ID:
1
File name:
1780981094-204106-7662-29351-1.eml
Verdict:
Malicious activity
Analysis date:
2026-06-09 12:38:00 UTC
Tags:
attachments attc-eml susp-attachments attc-unc remcos rat stealer
Link:
https://app.any.run/tasks/89b008cb-99ba-4cc2-9ed2-10f04b7c7eb2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Guloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/70812/
Detection(s):
SecuriteInfo.com.Trojan.Inject6.18267.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a301f8f34eaf30d8ce66331
Tags:
injection obfusc virus nsis
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file
Creating a file in the Windows subdirectories
Creating a file in the %temp% subdirectories
Delayed reading of the file
Unauthorized injection to a recently created process
Restart of the analyzed sample
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/b24d9b4fe10dec89c3585169731a20a070b4646e7e0c72bdaa550bc5969b306c
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-06-09T08:34:00Z UTC
Last seen:
2026-06-17T12:00:00Z UTC
Hits:
~1000
Detections:
Trojan.Makoob.HTTP.C&C HEUR:Trojan.NSIS.GuLoader.gen Trojan.Win32.Guloader.sb Trojan.NSIS.Makoob.sba Trojan-Downloader.Win32.Minix.sb HEUR:Trojan-Downloader.Win32.Minix.gen
Link:
https://opentip.kaspersky.com/b24d9b4fe10dec89c3585169731a20a070b4646e7e0c72bdaa550bc5969b306c/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/632674a1-9c6b-475b-bc9e-2c0d51775a22
Result
Threat name:
Remcos, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1928154
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to steal Internet Explorer form passwords
Creates autostart registry keys with suspicious names
Detected Remcos RAT
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Opens the same file many times (likely Sandbox evasion)
Sigma detected: Remcos
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file registry)
Unusual module load detection (module proxying)
Yara detected GuLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1928154 Sample: oOX6ckMphw.exe Startdate: 15/06/2026 Architecture: WINDOWS Score: 100 64 noip.epifaniastudio.com.br 2->64 66 bin.workcentral.shop 2->66 80 Found malware configuration 2->80 82 Antivirus detection for URL or domain 2->82 84 Multi AV Scanner detection for submitted file 2->84 86 5 other signatures 2->86 10 oOX6ckMphw.exe 32 2->10         started        14 Antivi.exe 23 2->14         started        16 Antivi.exe 21 2->16         started        18 Antivi.exe 21 2->18         started        signatures3 process4 file5 56 C:\Windows\Fonts\feriens.ini, ASCII 10->56 dropped 58 C:\Users\user\AppData\Local\...\System.dll, PE32 10->58 dropped 104 Tries to detect virtualization through RDTSC time measurements 10->104 106 Hides threads from debuggers 10->106 108 Unusual module load detection (module proxying) 10->108 110 Switches to a custom stack to bypass stack traces 10->110 20 oOX6ckMphw.exe 2 10 10->20         started        25 oOX6ckMphw.exe 10->25         started        60 C:\Users\user\AppData\Local\...\System.dll, PE32 14->60 dropped 112 Found direct / indirect Syscall (likely to bypass EDR) 14->112 27 Antivi.exe 14->27         started        29 Antivi.exe 14->29         started        114 Opens the same file many times (likely Sandbox evasion) 16->114 signatures6 process7 dnsIp8 68 bin.workcentral.shop 172.67.142.20, 443, 49691, 49692 CLOUDFLARENET-CloudflareIncUS Canada 20->68 46 C:\Users\user\AppData\Roaming\...\Antivi.exe, PE32 20->46 dropped 48 C:\Users\user\...\Antivi.exe:Zone.Identifier, ASCII 20->48 dropped 88 Detected Remcos RAT 20->88 90 Creates autostart registry keys with suspicious names 20->90 92 Hides threads from debuggers 20->92 31 Antivi.exe 23 20->31         started        35 oOX6ckMphw.exe 20->35         started        94 Opens the same file many times (likely Sandbox evasion) 27->94 file9 signatures10 process11 file12 62 C:\Users\user\AppData\Local\...\System.dll, PE32 31->62 dropped 72 Multi AV Scanner detection for dropped file 31->72 74 Tries to steal Mail credentials (via file registry) 31->74 76 Contains functionality to steal Internet Explorer form passwords 31->76 78 5 other signatures 31->78 37 Antivi.exe 4 10 31->37         started        42 Antivi.exe 31->42         started        signatures13 process14 dnsIp15 70 noip.epifaniastudio.com.br 64.89.160.122, 2404, 49693, 49694 GHOSTYNETWORKSUS Luxembourg 37->70 50 C:\Users\user\AppData\...\Login Data.tmp, SQLite 37->50 dropped 52 C:\Users\user\AppData\...\Login Data.tmp, SQLite 37->52 dropped 54 C:\Users\user\...\Login Data For Account.tmp, SQLite 37->54 dropped 96 Detected Remcos RAT 37->96 98 Tries to harvest and steal browser information (history, passwords, etc) 37->98 100 Hides threads from debuggers 37->100 102 Found direct / indirect Syscall (likely to bypass EDR) 37->102 44 Antivi.exe 37->44         started        file16 signatures17 process18
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b24d9b4fe10dec89c3585169731a20a070b4646e7e0c72bdaa550bc5969b306c
Gathering data
Detection:
remcos
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b24d9b4fe10dec89c3585169731a20a070b4646e7e0c72bdaa550bc5969b306c/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/b24d9b4fe10dec89c3585169731a20a070b4646e7e0c72bdaa550bc5969b306c
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-06-09 11:57:19 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wjgzwt7bbxwitq2ykfuxggraubylizdopyghfpnkkuf4lfu3gbwa._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
0399c34993fa4537408a571820f9f1d8b56c0348007baf90c2c93cd88085ac7d
GuLoader
09f1b9609beb0339a6111e53354f2b1b160022e908771b8f03a67c214def996e
GuLoader
3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c
GuLoader
572604c4c9fa2bd8b7ba646845d8f18fd6d0644a278390bb764079182a4b23b0
GuLoader
6a18a2fdbd3a21a5af6781b84d85ce741bf8088b91e9fe1191174f6581964d20
GuLoader
7c3335bf6c2f5b7ca5bd189f70e3f39095ee5df24353462694b9498d108835bf
GuLoader
8d6b1eb9182980493d21fb6d78435775b0fd33ece6bc17c53e1eeaf084a7f975
GuLoader
9d3a4319952de04093b0b9515cfc0ead76aab32013c070499437b08a05e879f3
GuLoader
accd2edebbbdc5561f77d4452acebf376808771ad59bade59f9d5c3a39804cdf
GuLoader
e7657ddee5e6e3ed9c1fc9e4ad949379e06117ec589d0c3234a4fb4e513f46dd
GuLoader
+ 2'422 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:remcos botnet:remotehost collection discovery persistence rat spyware stealer
Link:
https://tria.ge/reports/260615-tawm3acw31/
Behaviour
Modifies registry class
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
outlook_office_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Family: Remcos
Malware Config
C2 Extraction:
noip.epifaniastudio.com.br:2404
Unpacked files
SH256 hash:
b24d9b4fe10dec89c3585169731a20a070b4646e7e0c72bdaa550bc5969b306c
MD5 hash:
27a6a80adc174c46a9babcad794da0b9
SHA1 hash:
d8c8be746f58d0f07ad0a22bfa391af6075a5557
Link:
https://www.unpac.me/results/1ce18995-c50a-413c-8c07-7c2b893bcf13/
SH256 hash:
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 hash:
cff85c549d536f651d4fb8387f1976f2
SHA1 hash:
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
Link:
https://www.unpac.me/results/1ce18995-c50a-413c-8c07-7c2b893bcf13/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b24d9b4fe10d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b24d9b4fe10dec89c3585169731a20a070b4646e7e0c72bdaa550bc5969b306c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/70812/

Comments