🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1e5fc4a1896dc1cf4388f2d135b560bed2ac2a6ea10bbe9fba436ec3eede858. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1e5fc4a1896dc1cf4388f2d135b560bed2ac2a6ea10bbe9fba436ec3eede858
SHA3-384 hash: 18ae8813e89cc25c52058ca0a1fce96b49cfa0cd29c49ba83195170ba2d5c2a67c3158e3ab8b2430e300d5ec190935cf
SHA1 hash: 72b563d8e60a8ce376c7054d518f2a08f50d702f
MD5 hash: 802c428d0bdf43348155933e45402195
humanhash: tennis-lithium-asparagus-undress
File name:justificanteXdeXtransferenciaX-X7889893409.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:969'439 bytes
First seen:2026-05-20 18:11:37 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:PgivSnnhxZzYTnGMNQHnJt+T8VJcBy0Mb6k06gf4KyR0Ej:PJvE9spN4b+T8V7b66p7R08
TLSH T1EF253381D687758C6746B4C7E3C32F920D27BA063E99BB78B490B71AD6D3730C6441AE
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter TomU
Tags:GuLoader rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
25
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:justificante de transferencia - 7889893409.exe
File size:1'045'120 bytes
SHA256 hash: 60814232e8b491aa42c4d37ec185c738319beb104f65ee579f017a4750c04eea
MD5 hash: 4060ccad239038c4a6485563f6a28287
MIME type:application/x-dosexec
Signature GuLoader
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f000356c-45d3-44e3-921a-c173078e5312/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a0df4ba4159ce11f601d5ad
Tags:
uloader virus agent
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug evasive expired-cert installer installer installer-heuristic microsoft_visual_cc nsis reconnaissance signed
Link:
https://www.filescan.io/uploads/6a0e00a178f38c56ac73fc3f/reports/d2309b19-23f9-4ace-9458-4a2099e0c7d2/overview
Verdict:
Suspicious
Labled as:
Mal/DrodRar
Link:
https://www.hybrid-analysis.com/sample/c1e5fc4a1896dc1cf4388f2d135b560bed2ac2a6ea10bbe9fba436ec3eede858
Verdict:
Malicious
File Type:
rar
First seen:
2025-04-14T07:17:00Z UTC
Last seen:
2026-05-20T15:28:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/c1e5fc4a1896dc1cf4388f2d135b560bed2ac2a6ea10bbe9fba436ec3eede858/results?tab=lookup
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c1e5fc4a1896dc1cf4388f2d135b560bed2ac2a6ea10bbe9fba436ec3eede858/
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2025-04-14 10:16:28 UTC
AV detection:
21 of 36 (58.33%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c1e5fc4a1896dc1cf4388f2d135b560bed2ac2a6ea10bbe9fba436ec3eede858

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_SliverFox_String
Create hunting rule
Author:huoji
Description:Detect files is `SliverFox` malware
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar c1e5fc4a1896dc1cf4388f2d135b560bed2ac2a6ea10bbe9fba436ec3eede858

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments