MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb5325281c5ecc2983de4e3d349cfa6fc272d3a9920aef743352386405ea280f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb5325281c5ecc2983de4e3d349cfa6fc272d3a9920aef743352386405ea280f
SHA3-384 hash: 796086f51839d4ea07499755f766b74eba2d8deca563f78033fa7ea03e160a6a457ca970fd6cfeb825075752a5802c8a
SHA1 hash: fb7172c40bc110e63f5f3ecb15c5950b13590bb3
MD5 hash: fd419c013cadaa2100ada7f6f7dd34f4
humanhash: delta-beer-sixteen-william
File name:rFACTURAJUNIO.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:424'160 bytes
First seen:2026-07-16 01:00:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f4639a0b3116c2cfc71144b88a929cfd (137 x GuLoader, 55 x Formbook, 40 x VIPKeylogger)
ssdeep 12288:FXuLq+uHdADtab75cdDMUxM9VGe/m/UD4K:FXuLqLKDtCdchR0G86UDJ
Threatray 2'696 similar samples on MalwareBazaar
TLSH T1B694129662D4C523C7755E78F8A8C6DDABBCBE10E0B44BA753E0764EFC26E81450B321
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 8ceecaccf7d4ccd0 (2 x GuLoader)
Reporter FXOLabs
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:Langhalm
Issuer:Langhalm
Algorithm:sha256WithRSAEncryption
Valid from:2026-06-03T03:42:37Z
Valid to:2027-06-03T03:42:37Z
Serial number: 1c19a02ce7569330f41890e2d6def0bc60d449fc
Thumbprint Algorithm:SHA256
Thumbprint: 7b9d20acda9ef73ba24be938f3d8a6e4ba6c2161be3827a87fc55deac66dcd05
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
190
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
GuLoader NSIS
Details
Link:
https://research.acce.ciphertechsolutions.com/results/e34d204c-cbde-457e-89a3-7325597cbf94/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/74843/
Detection(s):
SecuriteInfo.com.Other.Malware-gen.21434473.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a582d78b3055706bb55643b
Tags:
n/a
Verdict:
Suspicious
Labled as:
Injector.GFPM
Link:
https://www.hybrid-analysis.com/sample/cb5325281c5ecc2983de4e3d349cfa6fc272d3a9920aef743352386405ea280f
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-15T17:37:00Z UTC
Last seen:
2026-07-17T19:40:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/cb5325281c5ecc2983de4e3d349cfa6fc272d3a9920aef743352386405ea280f/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ce841ab6-a2ed-4e23-81ba-32676fb88c9f
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cb5325281c5ecc2983de4e3d349cfa6fc272d3a9920aef743352386405ea280f
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/fd419c013cadaa2100ada7f6f7dd34f4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb5325281c5ecc2983de4e3d349cfa6fc272d3a9920aef743352386405ea280f/
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2026-07-16 01:02:29 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=znjskka4l3gcta66jy6tjhh2n7bhfu5jsifo65btki4gibpkfahq._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
2ff71d6b1ba2c2ebe801611dedf98f7f62b0543fa356ed1e2827f244a2c55426
GuLoader
40954b27b8d9c5affe5035f26727cf48ddbc3479cc0aefa75f4394637534bb57
GuLoader
4bb00eb0cd1e15ec069e479a6b42e746e6faf74f9b7625cd0c100036a0e592d1
GuLoader
5e8e303f85b17263f85044d1e8dd593477755c753d13664bac9ba8f53241ec26
GuLoader
600d4f1ca00a93e7e684c9b7efa436f09ef7f8edab035a9a7d06b2519fc1e0c1
GuLoader
6309b0b350542faf15428804903568533e671e768ca928a15479fe5f021a03b9
GuLoader
ac7b40b43f0ff44f49204759c680dbe7e6973d53a778500478b00f71a6c37eae
GuLoader
be44b0c3b1a11814cbf7709d5d797d40e81df3836b34ec055202a22b21c6e3f2
GuLoader
c802e37cd04a2a3c6b4215350373c4cf90611eda4cf5a83a94782e9af90c8f5d
GuLoader
dce04b626574c990b7a1d873006c10a7f3fdfca21f63660e36a9e681f588825f
GuLoader
error
GuLoader
+ 2'686 additional samples on MalwareBazaar
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:guloader discovery downloader
Link:
https://tria.ge/reports/260716-bdk2mads3t/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Loads dropped DLL
Family: Guloader,Cloudeye
Unpacked files
SH256 hash:
cb5325281c5ecc2983de4e3d349cfa6fc272d3a9920aef743352386405ea280f
MD5 hash:
fd419c013cadaa2100ada7f6f7dd34f4
SHA1 hash:
fb7172c40bc110e63f5f3ecb15c5950b13590bb3
Link:
https://www.unpac.me/results/a73a54b4-1f9e-45ec-ba83-37e923b9ddbc/
SH256 hash:
23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 hash:
192639861e3dc2dc5c08bb8f8c7260d5
SHA1 hash:
58d30e460609e22fa0098bc27d928b689ef9af78
Link:
https://www.unpac.me/results/a73a54b4-1f9e-45ec-ba83-37e923b9ddbc/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cb5325281c5e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb5325281c5ecc2983de4e3d349cfa6fc272d3a9920aef743352386405ea280f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:NSIS
Create hunting rule
Author:kevoreilly
Description:NSIS Integrity Check function
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe cb5325281c5ecc2983de4e3d349cfa6fc272d3a9920aef743352386405ea280f

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/74843/

Comments