MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4ea21927cb25b5e3123374e9bee0a916d6bc74b1ce59b721be7c8d01b94b2cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4ea21927cb25b5e3123374e9bee0a916d6bc74b1ce59b721be7c8d01b94b2cd
SHA3-384 hash: 1c6f4775d660d99a2e3cba1a9d2e973aec6ff9689a972af0ecf25544d394b2d33c94f0faffee46b71d09f229834de966
SHA1 hash: 6478bcbc7232c5aa7914649b8ae943ee2b90631f
MD5 hash: 405c1f3f3bf06ae63253ba672eb08053
humanhash: chicken-maryland-nevada-berlin
File name:P#346374_SALE ORDER 2026.bat.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:811'666 bytes
First seen:2026-01-26 15:22:01 UTC
Last seen:2026-02-05 15:39:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e2f3f8ec66b7e1900c37978aca89d3c5 (21 x GuLoader, 6 x RemcosRAT, 4 x AgentTesla)
ssdeep 12288:SqNbPEhKXviT7xfAHsosRd9tcvVQ+BLqZoHYszFtHf3K2mtx:bbPEk6/xUG3c9Q+pq6zCN3
Threatray 2'486 similar samples on MalwareBazaar
TLSH T1B705010F7268C1AEDAF91FB0F4669CF5920DAC245C64048E63D933EEA6F62F1431A547
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 01b333b6cec6ce00 (9 x GuLoader, 2 x PhantomStealer)
Reporter James_inthe_box
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
148
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
NSIS
Details
Link:
https://research.acce.ciphertechsolutions.com/results/8566acda-ee7a-497d-9e9e-6e7dc6ec34d4/
Malware family:
n/a
ID:
1
File name:
P#346374_SALE ORDER 2026.bat.exe
Verdict:
Malicious activity
Analysis date:
2026-01-26 15:22:57 UTC
Tags:
stealer crypto-regex phantom auto-reg ims-api generic telegram
Link:
https://app.any.run/tasks/569a89c3-f150-49fb-bd1b-96c154c7c76f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/50226/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=697786aa6fa3eed1652f28b7
Tags:
injection obfusc virus
Verdict:
Malicious
Labled as:
Malware_52.7
Link:
https://www.hybrid-analysis.com/sample/b4ea21927cb25b5e3123374e9bee0a916d6bc74b1ce59b721be7c8d01b94b2cd
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-26T07:07:00Z UTC
Last seen:
2026-01-28T12:53:00Z UTC
Hits:
~1000
Detections:
Trojan-PSW.Win32.Stealer.sb Trojan-Downloader.Win32.Minix.sb VHO:Trojan-PSW.Win32.ReaderDB.gen Trojan.Win32.GuLoader.sb Trojan.NSIS.Makoob.qu PDM:Trojan.Win32.Generic Trojan-Dropper.Win32.Injector.sb Trojan.NSIS.Makoob.sba
Link:
https://opentip.kaspersky.com/b4ea21927cb25b5e3123374e9bee0a916d6bc74b1ce59b721be7c8d01b94b2cd/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/3cddba48-dea1-44af-9670-abf3255dfb7f
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b4ea21927cb25b5e3123374e9bee0a916d6bc74b1ce59b721be7c8d01b94b2cd
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4ea21927cb25b5e3123374e9bee0a916d6bc74b1ce59b721be7c8d01b94b2cd/
Verdict:
Malicious
Threat:
Family.PHANTOM
Link:
https://tip.neiki.dev/file/b4ea21927cb25b5e3123374e9bee0a916d6bc74b1ce59b721be7c8d01b94b2cd
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Suspicious
First seen:
2026-01-26 10:01:50 UTC
File Type:
PE (Exe)
Extracted files:
32
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wtvcdet4wjnv4mjdg5hjx3qksfwwxr2ldtszw4q347enag4uwlgq._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
269c04323cbd684de4b0edbb85cba6288444b24348476272ef9d0b167b7debeb
GuLoader
5c6dabfd88cc55ca9697acf98987e8d267670be9f970ce4a445c90a450c32051
GuLoader
88147aad7aa96d552ff975e54a28a013be2a82510226daf9e5bba144912e8ac3
GuLoader
8d126dd8b90ef12045e9576a5b28d796c9edbe522789333572210397519ef521
GuLoader
a193b9010ae51ca97aaeb7a82ec5433ce8f79549cd3c1d48e4b6308fea98f449
GuLoader
ad34ad3229e87f609a8584bebe6a3f70721c03a575f6b5d8eb2997a23bed04de
GuLoader
e4b394710171888c98115ff1cc8639992a746c3313363565ca8f54b237fc4ec2
GuLoader
e69fd545558a7dcfa322d010a159ecbcdf6930b5e991325367aca2667949db69
GuLoader
e7ee34ee21a62eebc2c09d2313efd23dbe4ebf1f9db7d60dea2026f900cdacd9
GuLoader
error
GuLoader
f207a6b7ffd3ebfa17aa3fcc222ca05c96bfedee29bae160d382d903be3f9e0a
GuLoader
+ 2'476 additional samples on MalwareBazaar
Result
Malware family:
phantom_stealer
Create hunting rule
Score:
  10/10
Tags:
family:phantom_stealer collection discovery installer persistence spyware stealer
Link:
https://tria.ge/reports/260126-sr1gxafs6f/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
NSIS installer
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses Microsoft Outlook profiles
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Looks up external IP address via web service
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Detects PhantomStealer payload
PhantomStealer
Phantom_stealer family
Malware Config
C2 Extraction:
https://api.telegram.org/bot8460788277:AAFeXlPKINAWlQ6o47wF9EDN3oz-wjXNSQk/sendMessage?chat_id=5019476480
Unpacked files
SH256 hash:
b4ea21927cb25b5e3123374e9bee0a916d6bc74b1ce59b721be7c8d01b94b2cd
MD5 hash:
405c1f3f3bf06ae63253ba672eb08053
SHA1 hash:
6478bcbc7232c5aa7914649b8ae943ee2b90631f
Link:
https://www.unpac.me/results/9ef041a2-0f22-4656-bd6e-386951cf4676/
SH256 hash:
7853be9190489ba84dae8232e9a967cec02d941732cb4137bc9ae6a392e89fb8
MD5 hash:
3fbd78c889fa40a2e5567b980c57b7db
SHA1 hash:
303564bfa6fd5ab7a65d35ae1cd14a05643b6b5d
Link:
https://www.unpac.me/results/9ef041a2-0f22-4656-bd6e-386951cf4676/
SH256 hash:
a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
MD5 hash:
81e268e27dbbcadbf116b5a9402195ab
SHA1 hash:
bd2b701b2e5e279786e179bceee2dc132a2afc37
Link:
https://www.unpac.me/results/9ef041a2-0f22-4656-bd6e-386951cf4676/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b4ea21927cb2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.79
Link:
https://yomi.yoroi.company/submissions/b4ea21927cb25b5e3123374e9bee0a916d6bc74b1ce59b721be7c8d01b94b2cd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/50226/

Comments