🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5042edbf89363f7688edde81add59d3a5b8a6797cf377e44af7054ca587ae4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f5042edbf89363f7688edde81add59d3a5b8a6797cf377e44af7054ca587ae4a
SHA3-384 hash: b0a30c369f4da148a1bb5f10915653cf6c83c4ae1ee7b6f5fe5e3f8b3b0839e7132dae49cb58f71bf5f627a7cd052704
SHA1 hash: 19a340c9a0f822549b554ace115bfe4a6bffb86b
MD5 hash: 53d45794897296053ae1799ffeda0efa
humanhash: xray-north-thirteen-delta
File name:ADVANCE_TT_SLIP.arj.zip
Download: download sample
Signature GuLoader
Create hunting rule
File size:346'372 bytes
First seen:2026-05-20 16:35:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:YCAxyN3Om6v5iYZpdLvm3nM/BJM0AqGPLkX4WlpmE0ihaU8aVr0Sqty9GrVM2JBR:LpOhS3niM/PLaMK8I0SJAVrr
TLSH T1997423865880F7D7340A46E84AE25DEB0FCD9B69292444E8467573EE294FF2E3A3144F
Magika zip
Reporter TomU
Tags:exe GuLoader zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
CH CH
File Archive Information

This file archive contains 10 file(s), sorted by their relevance:

File name:Mnstrede
File size:108'442 bytes
SHA256 hash: 5e738605da0fbf0a454cd6b66603d22108e59f5ac1abc4c97d323776acfdeb1f
MD5 hash: 1fadb8662e617c63355f1610b249c3c1
MIME type:application/octet-stream
Signature GuLoader
File name:skabiosens.pho
File size:84'855 bytes
SHA256 hash: 0f03986409fe5325ab8f446a911eab6a6091ef91f49b4b750468277881bb5939
MD5 hash: 4b91e0cea2eb292f21366a1182b70c02
MIME type:application/octet-stream
Signature GuLoader
File name:Exorcizes
File size:230'228 bytes
SHA256 hash: 462e21eb0f28840b89c091bf041fda02ac8ffe17e81909a830220b2336921545
MD5 hash: b4708f17c1368674815f1cb85ebca670
MIME type:application/octet-stream
Signature GuLoader
File name:System.dll
File size:11'776 bytes
SHA256 hash: bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 hash: 17ed1c86bd67e78ade4712be48a7d2bd
MIME type:application/x-dosexec
Signature GuLoader
File name:skemalisten.hap
File size:65'996 bytes
SHA256 hash: 439931f0aaa24d3332f84ea45d40f93b56b2948c56be92e78482a1989a491a61
MD5 hash: 2ff34998dea0aab0118e1239e551d446
MIME type:application/octet-stream
Signature GuLoader
File name:snapsetingets.ban
File size:30'258 bytes
SHA256 hash: 5fdca3348172651116726134565e6e46a1e82aadfc9ba57a6fa5333d7329d3b2
MD5 hash: f7084a1fb0f96f967b4977b3fc4c6c14
MIME type:application/octet-stream
Signature GuLoader
File name:ADVANCE_TT_SLIP.bat
File size:375'561 bytes
SHA256 hash: ccd0a1b439fb4fc8977c48b8361c2d041e240e897d423aa7019fe6efb5410ad5
MD5 hash: 454d4e3e306cb450d303ad19ea19ddbc
MIME type:application/x-dosexec
Signature GuLoader
File name:bioelectricity.udd
File size:24'241 bytes
SHA256 hash: 27696bbeca252447cd36391adf04dc2b446b319a4b06b8e5a48668957d00ef05
MD5 hash: 1ae8e9847cd22cd7d60a83f7694d7e27
MIME type:application/octet-stream
Signature GuLoader
File name:affutage.sta
File size:49'015 bytes
SHA256 hash: 6e22059433c4c4beb58c5c237e3cced842e612f959eb9798e16e8e3d1d53ff00
MD5 hash: 38f4dad87089422df42ec16bc4afa76b
MIME type:application/octet-stream
Signature GuLoader
File name:Daniela166.psy
File size:70'539 bytes
SHA256 hash: 31e86baa33fe26cb64a41263b0f24c2a483ad0aff4c8abc2e6095abb8ace9769
MD5 hash: db5aa155f527a0f20bbc59bef3201713
MIME type:application/octet-stream
Signature GuLoader
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/9f441f0e-7964-4ccf-955f-6069fbfbef36/
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a0de3224159ce11f601bde8
Tags:
injection obfusc virus
Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/f5042edbf89363f7688edde81add59d3a5b8a6797cf377e44af7054ca587ae4a/results/dashboard
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug evasive installer installer installer-heuristic microsoft_visual_cc nsis packed reconnaissance
Link:
https://www.filescan.io/uploads/6a0de349875badc3b38ea1b6/reports/2d4d80f5-0bbe-4b14-aa46-3073f133af3a/overview
Verdict:
Suspicious
Link:
https://www.hybrid-analysis.com/sample/f5042edbf89363f7688edde81add59d3a5b8a6797cf377e44af7054ca587ae4a
Verdict:
Malicious
File Type:
zip
First seen:
2026-05-10T19:03:00Z UTC
Last seen:
2026-05-19T23:43:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/f5042edbf89363f7688edde81add59d3a5b8a6797cf377e44af7054ca587ae4a/results?tab=lookup
Score:
60%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/f5042edbf89363f7688edde81add59d3a5b8a6797cf377e44af7054ca587ae4a
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f5042edbf89363f7688edde81add59d3a5b8a6797cf377e44af7054ca587ae4a/
Verdict:
Malicious
Threat:
Family.REMCOS
Link:
https://tip.neiki.dev/file/f5042edbf89363f7688edde81add59d3a5b8a6797cf377e44af7054ca587ae4a
Threat name:
Win32.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2026-05-10 23:56:56 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ucc5w7ysnr7o2eo3xubvxkz2os3rjtzptzxpzck64cuzjmhvzfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.79
Link:
https://yomi.yoroi.company/submissions/f5042edbf89363f7688edde81add59d3a5b8a6797cf377e44af7054ca587ae4a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

zip f5042edbf89363f7688edde81add59d3a5b8a6797cf377e44af7054ca587ae4a

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments