🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7faa0a20574065bb08fed4a40a2818e6b0284825a6b8ed6026dcf590f2e304f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c7faa0a20574065bb08fed4a40a2818e6b0284825a6b8ed6026dcf590f2e304f
SHA3-384 hash: 9ab5920cb1993da8fa301359a02f5c2589516879a961b673a0396787f2885221c51314d22a5327011be0ffae55aad286
SHA1 hash: 16b635cf3538b8428b242747299b38cc74da5231
MD5 hash: e64866676458473ef80d9a6017ecb7dc
humanhash: beer-lake-apart-oregon
File name:PO25_00026_MERCOID.rar
Download: download sample
Signature GuLoader
Create hunting rule
File size:895'782 bytes
First seen:2026-05-20 18:13:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:7brAaNhx10XcjRfLl5KdvWeERxM7PijEEf1v:7HHx10XohSdvhEpIEN
TLSH T1C51533AB1DD677FFCBF0C8E9985A170E350F8AD5469B1E18CD1A649CD8162E6B0C0CD8
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter TomU
Tags:GuLoader rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
24
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:PO25_00026_MERCOID.exe
File size:1'034'360 bytes
SHA256 hash: d1e75f4de10a7e3d6c59bd425c671d806b2d081c67f07f4c8602b2cb99c6a9a1
MD5 hash: 7ce9d9629fcb36a1015290badf3fb4d4
MIME type:application/x-dosexec
Signature GuLoader
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/90e9fe86-acd8-4bf3-89ec-13b172c45a58/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a0e17324159ce11f601fd25
Tags:
applicunwnt injection virus
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug base64 base64 evasive expired-cert installer installer installer-heuristic microsoft_visual_cc nsis phishing reconnaissance signed smb
Link:
https://www.filescan.io/uploads/6a0e00deefbd399b39c03555/reports/851b8376-f88f-4a8d-977f-5cbfab338233/overview
Verdict:
Malicious
Labled as:
Trojan.Downloader
Link:
https://www.hybrid-analysis.com/sample/c7faa0a20574065bb08fed4a40a2818e6b0284825a6b8ed6026dcf590f2e304f
Verdict:
Malicious
File Type:
rar
First seen:
2025-03-02T21:05:00Z UTC
Last seen:
2026-05-20T10:55:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/c7faa0a20574065bb08fed4a40a2818e6b0284825a6b8ed6026dcf590f2e304f/results?tab=lookup
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c7faa0a20574065bb08fed4a40a2818e6b0284825a6b8ed6026dcf590f2e304f/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Suspicious
First seen:
2025-03-03 02:03:28 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y75kbiqfoqdfxmep5vfebiubrzvqfbecljvy5vqcnxhvsdzogbhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.52
Link:
https://yomi.yoroi.company/submissions/c7faa0a20574065bb08fed4a40a2818e6b0284825a6b8ed6026dcf590f2e304f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_all_IPv6_variants
Create hunting rule
Author:Bierchermuesli
Description:Generic IPv6 catcher
Rule name:Detect_SliverFox_String
Create hunting rule
Author:huoji
Description:Detect files is `SliverFox` malware
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar c7faa0a20574065bb08fed4a40a2818e6b0284825a6b8ed6026dcf590f2e304f

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments