MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb898ee3c3dcadc6edb794c6ee22c40177431496b4ab6ec00de533ef60838194. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fb898ee3c3dcadc6edb794c6ee22c40177431496b4ab6ec00de533ef60838194
SHA3-384 hash:	518d1d24fef9047555315e595c65ddf0800853c052af112d4cd1bc9cd8e11914d2a50ba3a38309ff33321d55bb83ed9f
SHA1 hash:	9684ffe38239d24a44b9de4cfddecce7c3c4f19a
MD5 hash:	280bf21321767cf4c0e614e88bd94cdd
humanhash:	johnny-alabama-april-seven
File name:	REQXNO.88484.rar
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	1'098'457 bytes
First seen:	2026-05-21 13:57:38 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	24576:svA/6O5KLz+28F7GGzlG6U4evd9q6PUKOP8x:2A3KLz+T7GGzlG6FevhHOP8x
TLSH	T1DE3533A038DCE42972BCF1440CEF9EA6CBD535A1AE827650FAB17F6811CE2DD5741C86
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	GuLoader rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

28

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Noncapture19.exe
File size:	1'356'286 bytes
SHA256 hash:	c74dc1c9a7dfa5bade8c322a4b5a09f79025b6eabd0956c292b0879417f46f36
MD5 hash:	c8d8c1a429d415eee502919a3647e443
MIME type:	application/x-dosexec
Signature	GuLoader

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/e1b41b6b-d51c-4d63-97aa-600f131227d0/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.DownLoader47.49961.5583.21781.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a0f157698070a72bb9c655c

Tags:

shellcode injection virus

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context anti-debug evasive installer installer installer-heuristic microsoft_visual_cc nsis reconnaissance

Link:

https://www.filescan.io/uploads/6a0f1a62861ee596e6444522/reports/7cbc9457-f2de-4dc6-a303-e3b7a8368a2b/overview

Hybrid Analysis Trojan.GenericS

Verdict:

Malicious

Labled as:

Trojan.GenericS

Link:

https://www.hybrid-analysis.com/sample/fb898ee3c3dcadc6edb794c6ee22c40177431496b4ab6ec00de533ef60838194

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2024-11-08T06:48:00Z UTC

Last seen:

2025-11-13T06:48:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/fb898ee3c3dcadc6edb794c6ee22c40177431496b4ab6ec00de533ef60838194/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fb898ee3c3dcadc6edb794c6ee22c40177431496b4ab6ec00de533ef60838194/

ReversingLabs TitaniumCloud Win32.Trojan.GuLoader

Threat name:

Win32.Trojan.GuLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-11-06 20:34:25 UTC

File Type:

Binary (Archive)

Extracted files:

20

AV detection:

16 of 23 (69.57%)

Threat level:

  5/5

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery

Link:

https://tria.ge/reports/260521-semqaagv7q/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Windows directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Loads dropped DLL

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.79

Link:

https://yomi.yoroi.company/submissions/fb898ee3c3dcadc6edb794c6ee22c40177431496b4ab6ec00de533ef60838194