🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa9beba5c56041494c192ac43e554a126f4c2f89db8903f3b3016e2a1ee3e787. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa9beba5c56041494c192ac43e554a126f4c2f89db8903f3b3016e2a1ee3e787
SHA3-384 hash: 52f2e9b6ec7859846d256d7f6a2e561888c5ad9d3b59b19ba39e120906425e5c3f7aecaab2c735ed3a5901bc97457323
SHA1 hash: 4d54d88a3bfc9fa1b37a6a09f5caf10125cd546e
MD5 hash: 19b8a58e52a74938c32378ead9dc0534
humanhash: mango-mexico-coffee-johnny
File name:PEDIDOXPENDIENTE.tar
Download: download sample
Signature GuLoader
Create hunting rule
File size:751'104 bytes
First seen:2026-05-20 18:27:55 UTC
Last seen:Never
File type: tar
MIME type:application/x-tar
ssdeep 12288:qQpKcUk7Ej601NK8eGSuPBrajhS9hIYC1T/4Wp2tMZjzW68sI:qQQcUk7EV6GVuh2hIv1l7J8sI
TLSH T12CF41241FEA18453D8985AB00A6FD2B3EF77BC02AB11CA1B3744B75AFF7D194C542298
TrID 62.9% (.TAR/GTAR) TAR - Tape ARchive (GNU) (17/3)
37.0% (.TAR) TAR - Tape ARchive (file) (10/3)
Magika tar
Reporter TomU
Tags:GuLoader tar

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:PEDIDO PENDIENTE.exe
File size:749'158 bytes
SHA256 hash: 8465d20f102d638fe409b43e15f4ba77336ac426984c189d1b41f493a4eaff64
MD5 hash: 4d9b61111b2128e150fff37e0a32cf90
MIME type:application/x-dosexec
Signature GuLoader
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Variant.Jaik.63881.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a0e02794159ce11f601e153
Tags:
obfuscate xtreme virus
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug evasive installer installer installer-heuristic microsoft_visual_cc nsis reconnaissance
Link:
https://www.filescan.io/uploads/6a0e046defbd399b39c03d7f/reports/1ec29447-0471-4b17-97c3-1af464c602f6/overview
Verdict:
Suspicious
Labled as:
Mal/DrodTar
Link:
https://www.hybrid-analysis.com/sample/fa9beba5c56041494c192ac43e554a126f4c2f89db8903f3b3016e2a1ee3e787
Verdict:
Malicious
File Type:
tar
First seen:
2025-06-26T04:53:00Z UTC
Last seen:
2025-10-28T21:32:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/fa9beba5c56041494c192ac43e554a126f4c2f89db8903f3b3016e2a1ee3e787/results?tab=lookup
Score:
86%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/fa9beba5c56041494c192ac43e554a126f4c2f89db8903f3b3016e2a1ee3e787
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa9beba5c56041494c192ac43e554a126f4c2f89db8903f3b3016e2a1ee3e787/
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2025-06-25 16:09:59 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fa9beba5c56041494c192ac43e554a126f4c2f89db8903f3b3016e2a1ee3e787

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

tar fa9beba5c56041494c192ac43e554a126f4c2f89db8903f3b3016e2a1ee3e787

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments