🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f76270967e9fda2201f6c82a66638b536de9ec7cab9978604f67dbca5d1867bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f76270967e9fda2201f6c82a66638b536de9ec7cab9978604f67dbca5d1867bf
SHA3-384 hash: 641148455daf3c8a31dadbd546c9f7bdb976cd086699c1fa1b8793f926fa1bf5a5da363c446efc5625df487f417d693c
SHA1 hash: 347804f296ad77bd73d60b18ddbcf5a753530652
MD5 hash: f5f59427b5df24b4dd71453e975a426b
humanhash: jig-six-emma-one
File name:25013665.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:432'096 bytes
First seen:2025-09-18 10:15:28 UTC
Last seen:2025-10-09 14:02:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 671f2a1f8aee14d336bab98fea93d734 (204 x GuLoader, 4 x Formbook, 4 x RemcosRAT)
ssdeep 6144:evRLbNNZkPzfS6TM6MVFjQfoyAZpZYgG1YOAEoiR9+mDhfpzV6qj2vPQ:WbNNAXbIuJAZpC3mGFXXfpoqyw
TLSH T1EF94236236B1E0F3D97513301FF39F72AAE399F810612B574B4177867D70382AA29687
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon c4dadadad2f492c2 (148 x GuLoader, 51 x RemcosRAT, 23 x VIPKeylogger)
Reporter cocaman
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:Spine
Issuer:Spine
Algorithm:sha256WithRSAEncryption
Valid from:2025-09-06T03:03:30Z
Valid to:2026-09-06T03:03:30Z
Serial number: 1d1c6c5ec2627131ac3f11b220df5e698bbd3f26
Thumbprint Algorithm:SHA256
Thumbprint: 98b4cf8760a0521926c6c29ff0a155e2ec5aeed8ef89294e025e9e0f28cdff86
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
174
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
25013665.exe
Verdict:
Malicious activity
Analysis date:
2025-09-18 10:15:47 UTC
Tags:
stealer snake keylogger evasion telegram ims-api generic
Link:
https://app.any.run/tasks/a559220e-b3cd-450c-998a-c56a84b6a185

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/28126/
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68cbdbe588b954439247b495
Tags:
injection obfusc virus
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Searching for the window
Searching for the Windows task manager window
Launching a process
Creating a process with a hidden window
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a file
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context installer microsoft_visual_cc obfuscated overlay signed
Link:
https://www.filescan.io/uploads/68cbdbe6dbc6f5a29c4b9a27/reports/0347fbaf-7816-4f69-99d7-952021ec69e3/overview
Verdict:
Malicious
Labled as:
Trojan_Win32_Wacatac_B_ml
Link:
https://www.hybrid-analysis.com/sample/f76270967e9fda2201f6c82a66638b536de9ec7cab9978604f67dbca5d1867bf
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-17T06:26:00Z UTC
Last seen:
2025-09-17T06:26:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/f76270967e9fda2201f6c82a66638b536de9ec7cab9978604f67dbca5d1867bf/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/3e8d8118-e31d-48fa-b6c5-09312c4d0463
Result
Threat name:
GuLoader, MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1779928
Signature
AI detected suspicious PE digital signature
Early bird code injection technique detected
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queues an APC in another process (thread injection)
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected GuLoader
Yara detected MassLogger RAT
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1779928 Sample: 25013665.exe Startdate: 18/09/2025 Architecture: WINDOWS Score: 100 32 reallyfreegeoip.org 2->32 34 api.telegram.org 2->34 36 4 other IPs or domains 2->36 46 Suricata IDS alerts for network traffic 2->46 48 Found malware configuration 2->48 50 Multi AV Scanner detection for submitted file 2->50 56 6 other signatures 2->56 8 25013665.exe 23 2->8         started        11 svchost.exe 1 1 2->11         started        signatures3 52 Tries to detect the country of the analysis system (by using the IP) 32->52 54 Uses the Telegram API (likely for C&C communication) 34->54 process4 dnsIp5 24 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 8->24 dropped 26 C:\Users\user\...\Brneparkeringers.Moh, ASCII 8->26 dropped 14 powershell.exe 30 8->14         started        44 127.0.0.1 unknown unknown 11->44 file6 process7 file8 28 C:\Users\user\AppData\...behaviorgraphsteprofessors.exe, PE32 14->28 dropped 30 C:\...behaviorgraphsteprofessors.exe:Zone.Identifier, ASCII 14->30 dropped 66 Early bird code injection technique detected 14->66 68 Writes to foreign memory regions 14->68 70 Found suspicious powershell code related to unpacking or dynamic code loading 14->70 72 3 other signatures 14->72 18 Gsteprofessors.exe 15 8 14->18         started        22 conhost.exe 14->22         started        signatures9 process10 dnsIp11 38 api.telegram.org 149.154.167.220, 443, 49728 TELEGRAMRU United Kingdom 18->38 40 checkip.dyndns.com 158.101.44.242, 49726, 80 ORACLE-BMC-31898US United States 18->40 42 3 other IPs or domains 18->42 58 Multi AV Scanner detection for dropped file 18->58 60 Tries to steal Mail credentials (via file / registry access) 18->60 62 Tries to harvest and steal browser information (history, passwords, etc) 18->62 64 3 other signatures 18->64 signatures12
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f76270967e9fda2201f6c82a66638b536de9ec7cab9978604f67dbca5d1867bf
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/f5f59427b5df24b4dd71453e975a426b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f76270967e9fda2201f6c82a66638b536de9ec7cab9978604f67dbca5d1867bf/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2025-09-17 10:11:08 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=65rhbft6t7nceapwzavgmy4lknw6t3d4vomxqycpm7n4uxiym67q._file
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:guloader family:masslogger adware collection discovery downloader execution installer macos persistence ransomware spyware stealer
Link:
https://tria.ge/reports/250918-marwjszk15/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
NSIS installer
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses Microsoft Outlook profiles
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Guloader family
Guloader,Cloudeye
MassLogger
Masslogger family
Malware Config
C2 Extraction:
https://api.telegram.org/bot8382114271:AAHSbVPDbET_crWmchBbXRYm9X0nm-CRunM/sendMessage?chat_id=7629232865
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/396ddc06-7b11-4c5d-b96b-07a980c937ef
Unpacked files
SH256 hash:
f76270967e9fda2201f6c82a66638b536de9ec7cab9978604f67dbca5d1867bf
MD5 hash:
f5f59427b5df24b4dd71453e975a426b
SHA1 hash:
347804f296ad77bd73d60b18ddbcf5a753530652
Link:
https://www.unpac.me/results/ffc152f7-e861-4019-959b-63aa1aa3b496/
SH256 hash:
832da3cff792135ecb98f44c387bea3a8e2e9bd096b917303ca8b9dc71d60365
MD5 hash:
50a9396a761bf245ed4df1b08782d6f2
SHA1 hash:
e01a99100e91801abe074341b0c77cca6220f0bd
Link:
https://www.unpac.me/results/ffc152f7-e861-4019-959b-63aa1aa3b496/
SH256 hash:
bcb93204bd1854d0c34fa30883bab51f6813ab32abf7fb7d4aeed21d71f6af87
MD5 hash:
6c881f00ba860b17821d8813aa34dbc6
SHA1 hash:
0e5a1e09b1ce1bc758d6977b913a8d9ccbe52a13
Link:
https://www.unpac.me/results/ffc152f7-e861-4019-959b-63aa1aa3b496/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f76270967e9f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f76270967e9fda2201f6c82a66638b536de9ec7cab9978604f67dbca5d1867bf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

rar 7986707b0d2bdad3a3d3a003dfa941782b2d6312b044f6db93f66e99f18d9b53

GuLoader

Executable exe f76270967e9fda2201f6c82a66638b536de9ec7cab9978604f67dbca5d1867bf

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 7986707b0d2bdad3a3d3a003dfa941782b2d6312b044f6db93f66e99f18d9b53
Cape
Cape
https://www.capesandbox.com/analysis/28126/
  
Dropped by
MD5 94f6b001c65aa9e37c14c65b57556832

Comments