MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7577f2b26fdcf537bf6551bf5b7e3e0020bb7b4a538ba9c444a49ad09355034. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d7577f2b26fdcf537bf6551bf5b7e3e0020bb7b4a538ba9c444a49ad09355034
SHA3-384 hash:	d646602dd758bf25b93772f20eb6d1951e4ff95de6f8768203a99bb414006c6a255c5131d57ae1818a77bd19457504ad
SHA1 hash:	bacd4c84c11c375d6f47c575a1c97ea000935622
MD5 hash:	cd1850e4af9151d23923ba7f5079b509
humanhash:	moon-mango-pluto-potato
File name:	DBS_confirmation_of_funds_transfer_06_17_202600000000df.bat
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	2'715 bytes
First seen:	2026-06-18 05:48:38 UTC
Last seen:	2026-06-18 06:05:15 UTC
File type:	bat
MIME type:	text/plain
ssdeep	48:YoTy7ytU7WZuWKxUM2WeYkE54ihLcn0SRRB8kURosLN/YNg3Ul:YO74Wc7pN5x2/qkU2hN8Ul
TLSH	T12C5163B1830E1FBED6CD0884D3823247D0FA3C4876D29D467B35A9521D6F2E456A08D9
Magika	powershell
Reporter	lowmal3
Tags:	bat GuLoader purmed-ro

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

74

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

DBS_confirmation_of_funds_transfer_06_17_202600000000df.bat

Verdict:

Malicious activity

Analysis date:

2026-06-18 05:51:45 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b06cf0b0-0e1f-4ba6-815f-a8f95b3fecee

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/71122/

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.IA.Suspicious.83191289.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a3386c81a97308eef89fe65

Tags:

n/a

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching a process

Сreating synchronization primitives

DNS request

Connection attempt

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

base64 encrypted obfuscated powershell

Link:

https://www.filescan.io/uploads/6a3386c062d0679105f74ebf/reports/66bb8555-2bd0-4658-a467-53f1e798c3a5/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d7577f2b26fdcf537bf6551bf5b7e3e0020bb7b4a538ba9c444a49ad09355034

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2026-06-17T21:18:00Z UTC

Last seen:

2026-06-20T03:40:00Z UTC

Hits:

~100

Detections:

UDS:DangerousObject.Multi.Generic Trojan-Downloader.PowerShell.Agent.sb

Link:

https://opentip.kaspersky.com/d7577f2b26fdcf537bf6551bf5b7e3e0020bb7b4a538ba9c444a49ad09355034/results?tab=lookup

Joe Sandbox GuLoader

Result

Threat name:

GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1929746

Signature

Found suspicious powershell code related to unpacking or dynamic code loading

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Suspicious powershell command line found

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Unusual module load detection (module proxying)

Yara detected GuLoader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d7577f2b26fdcf537bf6551bf5b7e3e0020bb7b4a538ba9c444a49ad09355034

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d7577f2b26fdcf537bf6551bf5b7e3e0020bb7b4a538ba9c444a49ad09355034/

Neiki Trojan-Downloader.PowerShell.Agent

Verdict:

Malicious

Threat:

Trojan-Downloader.PowerShell.Agent

Link:

https://tip.neiki.dev/file/d7577f2b26fdcf537bf6551bf5b7e3e0020bb7b4a538ba9c444a49ad09355034

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.Heuristic

Threat name:

Script-PowerShell.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-18 03:15:02 UTC

File Type:

Text (Batch)

AV detection:

6 of 24 (25.00%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=25lx6kzg7xhvg67wkun7ln7d4abaxn5uuu4lvhcejje22cjvka2a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/260618-ghwxkse17p/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks QEMU agent file

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d7577f2b26fdcf537bf6551bf5b7e3e0020bb7b4a538ba9c444a49ad09355034

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

bat d7577f2b26fdcf537bf6551bf5b7e3e0020bb7b4a538ba9c444a49ad09355034

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/71122/