MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ece3ae892a0f73b9eed776be8750b45cafaa97b449b94991aad4b43963ee607b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

GuLoader

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments

SHA256 hash:	ece3ae892a0f73b9eed776be8750b45cafaa97b449b94991aad4b43963ee607b
SHA3-384 hash:	a1e8f73ceebcf2475935de6c9a7d1cf2cbd95f9799d84a7f0ae9d727fe1343413cd3da8cd2d782132e6a86cee95c6e1b
SHA1 hash:	bc31970cfffd744da4e9b0c99e2027db7e13b291
MD5 hash:	f8040475bae3471a5fe998290ea1fded
humanhash:	sink-solar-autumn-ink
File name:	ece3ae892a0f73b9eed776be8750b45cafaa97b449b94991aad4b43963ee607b
Download:	download sample
Signature	GuLoader Create hunting rule
File size:	459'768 bytes
First seen:	2026-02-05 15:40:55 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ea4e67a31ace1a72683a99b80cf37830 (75 x GuLoader, 71 x Formbook, 54 x Loki)
ssdeep	12288:7cODb7v0o8JvG5UFP+ibiucOTjjjjcjzjcjcjjYXgcNRlkBb/KRtbtps3iZaYMin:YO4njjjjcjzjcjcjjggYRlkl/KRt5QZs
Threatray	4'357 similar samples on MalwareBazaar
TLSH	T191A4D087FA80D1D2D91C487299B3873055BF7C78AA8D87C3B348725129332D65A3BE67
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	d292e8f0f0e8f0f0 (7 x GuLoader, 7 x PhantomStealer, 1 x Formbook)
Reporter	adrian__luca
Tags:	exe GuLoader signed

Code Signing Certificate

Organisation:	Hernioid
Issuer:	Hernioid
Algorithm:	sha256WithRSAEncryption
Valid from:	2026-01-23T02:16:42Z
Valid to:	2027-01-23T02:16:42Z
Serial number:	6237d04b3b6ce69a082e00afe16ee4b8af0c48ac
Thumbprint Algorithm:	SHA256
Thumbprint:	d90affd5d6f2c0033dc572ba820266520e37dcf549070040e6a19e4572f77332
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

122

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

NSIS

Details

Link:

https://research.acce.ciphertechsolutions.com/results/257f80c7-ec53-40e7-85d2-ecdee0babafd/

Malware family:

n/a

ID:

File name:

ece3ae892a0f73b9eed776be8750b45cafaa97b449b94991aad4b43963ee607b

Verdict:

Malicious activity

Analysis date:

2026-02-05 20:51:00 UTC

Tags:

auto-reg crypto-regex phantom stealer ims-api generic telegram evasion

Link:

https://app.any.run/tasks/d91404d8-0513-437d-b557-09b9ae0b02fc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Guloader

Link:

https://www.capesandbox.com/analysis/52148/

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6984ba5e117f8ed80109d3cd

Tags:

injection obfusc virus

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug blackhole guloader installer installer installer-heuristic microsoft_visual_cc nsis signed soft-404

Link:

https://www.filescan.io/uploads/6984ba2a930564ff3c8d2a2a/reports/c639e572-cc75-486e-a02a-f0f29242dd02/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/ece3ae892a0f73b9eed776be8750b45cafaa97b449b94991aad4b43963ee607b

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-01-26T02:59:00Z UTC

Last seen:

2026-02-07T07:21:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/ece3ae892a0f73b9eed776be8750b45cafaa97b449b94991aad4b43963ee607b/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/89e6bc2a-70ae-4734-aca8-16cf3bc35662

Score:

97%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/ece3ae892a0f73b9eed776be8750b45cafaa97b449b94991aad4b43963ee607b

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ece3ae892a0f73b9eed776be8750b45cafaa97b449b94991aad4b43963ee607b/

Threat name:

Win32.Trojan.Guloader

Status:

Malicious

First seen:

2026-01-26 06:36:31 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5tr25cjkb5z3t3wxo27ioufulsx2vf5ujg4utenk2s2dsy7omb5q._file

Verdict:

malicious

Label(s):

cloudeye

Result

Malware family:

phantom_stealer

Score:

10/10

Tags:

family:phantom_stealer collection discovery installer macos persistence spyware stealer

Link:

https://tria.ge/reports/260205-s41cnsbv7e/

Behaviour

outlook_win_path

outlook_office_path

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Modifies data under HKEY_USERS

Enumerates system info in registry

Checks processor information in registry

NSIS installer

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Windows directory

Drops file in Program Files directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtCreateThreadExHideFromDebugger

Looks up external IP address via web service

Contacts third-party web service commonly abused for C2

Adds Run key to start application

Accesses Microsoft Outlook profiles

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Phantom_stealer family

PhantomStealer

Detects PhantomStealer payload

Malware Config

C2 Extraction:

https://api.telegram.org/bot7991374459:AAGqLt4_FwfvWftSxNRxCJUe9JJnuwk3hag/sendMessage?chat_id=7362332542

Unpacked files

SH256 hash:

269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1

MD5 hash:

34442e1e0c2870341df55e1b7b3cccdc

SHA1 hash:

99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c

Link:

https://www.unpac.me/results/ca24b897-9f8a-4a56-9c50-437127992e31/

SH256 hash:

ece3ae892a0f73b9eed776be8750b45cafaa97b449b94991aad4b43963ee607b

MD5 hash:

f8040475bae3471a5fe998290ea1fded

SHA1 hash:

bc31970cfffd744da4e9b0c99e2027db7e13b291

Link:

https://www.unpac.me/results/ca24b897-9f8a-4a56-9c50-437127992e31/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.52

Link:

https://yomi.yoroi.company/submissions/ece3ae892a0f73b9eed776be8750b45cafaa97b449b94991aad4b43963ee607b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Ins_NSIS_Buer_Nov_2020_1 Create hunting rule
Author:	Arkbird_SOLG
Description:	Detect NSIS installer used for Buer loader

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/52148/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample