🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9b3f6e243495001fbaea282aaae7e9d4e7902530741cc4ca289ccedddb7a29f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9b3f6e243495001fbaea282aaae7e9d4e7902530741cc4ca289ccedddb7a29f
SHA3-384 hash: 3db5310d9ddf2b532fc8f8c25e0624a4e64a44b087c483dff5aaab61b7df972bbbaf7d9ca4a6f2780dbcd11401f537d2
SHA1 hash: 1dacdce80238068757c9d951ec1d2fb646757a36
MD5 hash: a65ac7a208cded81166b90bf4c125664
humanhash: angel-montana-nuts-high
File name:დღე მშვიდობისა,.hta
Download: download sample
Signature GuLoader
Create hunting rule
File size:21'538 bytes
First seen:2026-09-30 08:21:31 UTC
Last seen:Never
File type:HTML Application (hta) hta
MIME type:text/html
ssdeep 384:hItIXZEyBbT2JbQvYY1cdXRlIY+NZyDS9mlswIxmeY8yaGqeUE:atIXZEyB/2JEAY1oXRlnkZX9mlVimqy1
TLSH T1D4A24B71EA1D6517CD4636E8C9054C9388B880091063A1A1BEE5076FB607D6CE3FAFBF
Magika html
Reporter abuse_ch
Tags:GuLoader hta

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Result
Verdict:
Malicious
File Type:
HTA File - Malicious
Link:
https://app.docguard.net/f9b3f6e243495001fbaea282aaae7e9d4e7902530741cc4ca289ccedddb7a29f/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd lolbin
Link:
https://www.filescan.io/uploads/6abcc6c225669a719c0c0993/reports/518351e5-7158-4918-b383-ced8f95195d8/overview
Verdict:
Malicious
Labled as:
PowerShell/CloudEye.ML trojan
Link:
https://www.hybrid-analysis.com/sample/f9b3f6e243495001fbaea282aaae7e9d4e7902530741cc4ca289ccedddb7a29f
Verdict:
Malicious
File Type:
hta
First seen:
2026-09-29T06:26:00Z UTC
Last seen:
2026-10-01T07:11:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/f9b3f6e243495001fbaea282aaae7e9d4e7902530741cc4ca289ccedddb7a29f/results?tab=lookup
Result
Threat name:
GuLoader, Remcos
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1979900
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Powershell connects to network
Sigma detected: Suspicious MSHTA Child Process
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Unusual module load detection (module proxying)
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected GuLoader
Yara detected Remcos RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1979900 Sample: #U10d3#U10e6#U10d4 #U10db#U... Startdate: 30/09/2026 Architecture: WINDOWS Score: 100 87 daroughgan8hajous20.duckdns.org 2->87 89 tradingengineers.in 2->89 91 6 other IPs or domains 2->91 119 Suricata IDS alerts for network traffic 2->119 121 Found malware configuration 2->121 123 Malicious sample detected (through community Yara rule) 2->123 127 11 other signatures 2->127 11 mshta.exe 1 2->11         started        14 powershell.exe 2->14         started        16 powershell.exe 2->16         started        18 svchost.exe 1 1 2->18         started        signatures3 125 Uses dynamic DNS services 87->125 process4 dnsIp5 143 Obfuscated command line found 11->143 21 cmd.exe 1 11->21         started        23 powershell.exe 14->23         started        26 conhost.exe 14->26         started        28 powershell.exe 16->28         started        30 conhost.exe 16->30         started        93 127.0.0.1 unknown unknown 18->93 signatures6 process7 signatures8 32 powershell.exe 1 16 21->32         started        36 conhost.exe 21->36         started        38 cmd.exe 1 21->38         started        129 Writes to foreign memory regions 23->129 40 backgroundTaskHost.exe 23->40         started        42 backgroundTaskHost.exe 23->42         started        44 backgroundTaskHost.exe 28->44         started        46 backgroundTaskHost.exe 28->46         started        131 Installs a global keyboard hook 30->131 process9 dnsIp10 79 tradingengineers.in 23.153.104.2, 49699, 80 AQUIRYN-LLC-AquirynLLCUS United States 32->79 95 Writes to foreign memory regions 32->95 97 Found suspicious powershell code related to unpacking or dynamic code loading 32->97 99 Switches to a custom stack to bypass stack traces 32->99 101 Powershell connects to network 32->101 48 backgroundTaskHost.exe 6 17 32->48         started        53 backgroundTaskHost.exe 32->53         started        103 Installs a global keyboard hook 36->103 55 backgroundTaskHost.exe 40->55         started        signatures11 process12 dnsIp13 81 daroughgan8hajous20.duckdns.org 206.123.137.136, 29810, 49717, 49718 M247RO Sweden 48->81 83 fitman.ro 91.216.156.118, 443, 49714, 49719 MYSERVER-MEDIA-ASRO Romania 48->83 85 oz-courses.com 117.120.10.191, 443, 49715, 49720 AS45671-NET-AUWholesaleServicesProviderAU Australia 48->85 71 C:\Users\user\AppData\Local\Temp\THDA0F.tmp, MS-DOS 48->71 dropped 73 C:\Users\user\AppData\Local\Temp\THD9E0.tmp, MS-DOS 48->73 dropped 75 C:\Users\user\AppData\Local\Temp\THD9B0.tmp, MS-DOS 48->75 dropped 77 C:\Users\user\AppData\Roaming\lahkss.dat, data 48->77 dropped 105 Writes to foreign memory regions 48->105 107 Maps a DLL or memory area into another process 48->107 109 Installs a global keyboard hook 48->109 57 userinit.exe 1 48->57         started        60 userinit.exe 1 48->60         started        62 userinit.exe 48->62         started        64 4 other processes 48->64 111 Found hidden mapped module (file has been removed from disk) 53->111 113 Unusual module load detection (module proxying) 53->113 115 Switches to a custom stack to bypass stack traces 53->115 file14 signatures15 process16 signatures17 133 Tries to steal Instant Messenger accounts or passwords 57->133 135 Tries to steal Mail credentials (via file / registry access) 57->135 137 Tries to harvest and steal browser information (history, passwords, etc) 60->137 139 Tries to steal Mail credentials (via file registry) 62->139 141 Unusual module load detection (module proxying) 62->141 66 conhost.exe 64->66         started        69 reg.exe 1 1 64->69         started        process18 signatures19 117 Installs a global keyboard hook 66->117
Score:
96%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f9b3f6e243495001fbaea282aaae7e9d4e7902530741cc4ca289ccedddb7a29f
Verdict:
Malware
YARA:
3 match(es)
Tags:
COM Behavior Trace DeObfuscated Html Obfuscated Scripting.FileSystemObject SOS: 0.26 T1027 T1059.005 VBScript WScript.Shell
Link:
https://app.malva.re/file/a65ac7a208cded81166b90bf4c125664
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f9b3f6e243495001fbaea282aaae7e9d4e7902530741cc4ca289ccedddb7a29f/
Threat name:
Win32.Dropper.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-09-29 11:23:33 UTC
File Type:
Text (HTML)
Extracted files:
1
AV detection:
7 of 36 (19.44%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7gz7nysdjfiad65oukbkvlt6tvhhsasta5a4ytfcrhgo3xnxukpq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution
Link:
https://tria.ge/reports/260930-j9rhaasbja/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Executes a command shell one-liner
System Location Discovery: System Language Discovery
Enumerates connected drives
Checks computer location settings
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f9b3f6e243495001fbaea282aaae7e9d4e7902530741cc4ca289ccedddb7a29f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique
Rule name:Guloader_VBScript
Create hunting rule
Author:Ankit Anubhav - ankitanubhav.info
Description:Detects GuLoader/CloudEye VBScripts
Rule name:html_auto_download_b64
Create hunting rule
Author:Tdawg
Description:html auto download

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments