S0561 - GuLoader

GuLoader is a file downloader that has been used since at least December 2019 to distribute a variety of remote administration tool (RAT) malware, including NETWIRE, Agent Tesla, NanoCore, FormBook, and Parallax RAT.

Author
agomez
Created
2023-03-27 16:17:42
Last updated
2026-02-07 18:38:57
Downloads
714263
IPv4 indicators
1
Hostname indicators
1
URL indicators
5
Sample indicators
423

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

SHIPMT-97 6533 1936ROBUTECH.exe Sample

modified 2026-10-18 03:49:03
GuLoader (MalwareBazaar Abuse.ch) · SigLoader (ThreatFox Abuse.ch)

https://www.mediafire.com/file/lbm462q5os4x6tk/Tracking_Details.7z/file URL

modified 2026-10-17 18:31:16
GuLoader (Maltiverse Research Team) · AgentTesla (Maltiverse Research Team)

17102026_1745_15102026_650146738 PL.vbe.rar Sample

modified 2026-10-17 17:45:36
Guloader (Triage)

17102026_0936_16102026_BANCA IFIS SPA SMBGHSK83575735757358375385735.7z Sample

modified 2026-10-17 09:36:25
Guloader (Triage)

https://www.mediafire.com/file/6urm5ylq31a3s24/Odeme_makbuzu.7z/file URL

modified 2026-10-17 06:30:21
GuLoader (Maltiverse Research Team) · AgentTesla (Maltiverse Research Team)

df89b77a388f533015b83feb60744d95ac2d159fbee27951c3c42de794976df8 Sample

modified 2026-10-17 01:10:55
Guloader (Triage)

produbanco_pago_transferencias.pdf.exe Sample

modified 2026-10-16 19:34:12
Guloader (Triage)

75cb75d2d94c093aedcbc6d69a7ed92308b69d11452f1483a9e2223fc0c39f41 Sample

modified 2026-10-16 17:49:23
Guloader (Triage)

scan.xlsm.com Sample

modified 2026-10-16 17:19:00
GuLoader (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

6730474cce1605aa907059cdd4e1f2c853499d6417cc1847c970768703a2df9a Sample

modified 2026-10-16 09:00:32
Guloader (Triage)

JIU_XU_36_DESC.docx.rar Sample

modified 2026-10-16 07:25:18
Guloader (Triage) · RemcosRAT (MalwareBazaar Abuse.ch)

e0fc11c55c5269e1b2c12b824b8c18b8e6697f868253d072e5b82dde1c26ee03.bin Sample

modified 2026-10-16 05:47:48
GuLoader (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

Affektioner.vbs Sample

modified 2026-10-16 01:04:35
Guloader (Triage)

jaffacakes118_Trojan.Win32.Alien.giv.2912f892bd9c47219c59c04873d8f9a3 Sample

modified 2026-10-15 21:29:24
Guloader (Triage)

e8b80081185d67eeb24148b1e43f5341823283b06ef727154cf47c14c8912d8b Sample

modified 2026-10-15 15:54:06
GuLoader (Cyber Threat Alliance)

c4a820692b979d638177dbba36c14f5b34af582d53006b83bf63c68cf166e191 Sample

modified 2026-10-15 15:54:06
GuLoader (Cyber Threat Alliance)

f4ecaf945dc3e409891de28d254c859e814a0c37a9aa14c10ee694fcfdd11ecb Sample

modified 2026-10-15 15:22:45
Guloader (Cyber Threat Alliance)

026fff4de1f748ffc7a28135904b2961704d4f2ea08de24672d10c9428a159cc Sample

modified 2026-10-15 15:22:45
Guloader (Cyber Threat Alliance)

daa0e0cabf29c791261c9dc46201972b15b269563ad766c751f0fc896fa61eb0 Sample

modified 2026-10-15 15:22:45
Guloader (Cyber Threat Alliance)

79b390d618019bfb6cb0193795cc9d2a94d2622265c1bd3e87e115e17d03a9ef Sample

modified 2026-10-15 15:22:43
Guloader (Cyber Threat Alliance)

RPF1920485_20261015.js Sample

modified 2026-10-15 11:35:41
GuLoader (MalwareBazaar Abuse.ch)

jaffacakes118_Backdoor.Win32.Androm.ezvw.3fce9f284038165991620d69a4d7788c Sample

modified 2026-10-15 04:07:57
Guloader (Triage)

IMG - stampa il campione di pagamento di 2 pagine in 1 A4..js Sample

modified 2026-10-15 02:18:31
Agent Tesla (Triage) · Generic Malware (Triage) · GuLoader (MalwareBazaar Abuse.ch)

Employee_Performance_Report_2026.vbe Sample

modified 2026-10-14 20:59:07
Guloader (Triage) · RemcosRAT (MalwareBazaar Abuse.ch)

Pendaftaran Lembur September 2026.vbe Sample

modified 2026-10-14 18:32:15
Guloader (Triage) · RemcosRAT (MalwareBazaar Abuse.ch)

Heintjes.exe Sample

modified 2026-10-14 17:15:05
Guloader (Triage) · Formbook (MalwareBazaar Abuse.ch)

Rechnung.rar Sample

modified 2026-10-14 17:15:05
Guloader (Triage) · Formbook (MalwareBazaar Abuse.ch)

NEW_RFQ_#_6200471116.rar Sample

modified 2026-10-14 16:57:32
Guloader (Triage) · GuLoader (MalwareBazaar Abuse.ch)

Payment_Advice.rar Sample

modified 2026-10-14 16:57:32
GuLoader (MalwareBazaar Abuse.ch) · Guloader (Triage)

INVOICE_LIN2609644.arj.zip Sample

modified 2026-10-14 16:57:21
GuLoader (MalwareBazaar Abuse.ch) · Guloader (Triage)

Justificante_Pago_Certificado_Corriente_Pago-67788909-767676767676.tar.rar Sample

modified 2026-10-14 16:15:12
Guloader (Triage) · VIPKeylogger (MalwareBazaar Abuse.ch)

Justificante_Pago_Certificado_Corriente_Pago-67788909-767676767676.exe Sample

modified 2026-10-14 16:15:12
Guloader (Triage) · VIPKeylogger (MalwareBazaar Abuse.ch)

Transferencia_realizada_-7665565645-8778.tar.rar Sample

modified 2026-10-14 16:15:11
Guloader (Triage) · VIPKeylogger (MalwareBazaar Abuse.ch)

Arrival_Notice.vbe Sample

modified 2026-10-14 16:15:10
Guloader (Triage) · RemcosRAT (MalwareBazaar Abuse.ch)

NEW_ORDER.rar Sample

modified 2026-10-14 16:15:10
Guloader (Triage) · RemcosRAT (MalwareBazaar Abuse.ch)

ArrivalXNotice.rar Sample

modified 2026-10-14 16:15:10
Guloader (Triage) · RemcosRAT (MalwareBazaar Abuse.ch)

PaymentXAdvice.rar Sample

modified 2026-10-14 16:15:10
Guloader (Triage) · RemcosRAT (MalwareBazaar Abuse.ch)

Transferencia_realizada_-7665565645-8778.exe Sample

modified 2026-10-14 16:15:10
Guloader (Triage) · VIPKeylogger (MalwareBazaar Abuse.ch)

ORKIM_DIAMOND.rar Sample

modified 2026-10-14 16:15:09
Guloader (Triage) · RemcosRAT (MalwareBazaar Abuse.ch)

ORKIM_DIAMOND.vbe Sample

modified 2026-10-14 16:15:09
Guloader (Triage) · RemcosRAT (MalwareBazaar Abuse.ch)

BunkerandProforma.gz.zip Sample

modified 2026-10-14 16:15:08
Guloader (Triage) · GuLoader (MalwareBazaar Abuse.ch)

New-order12435735.tar Sample

modified 2026-10-14 16:15:08
Guloader (Triage) · GuLoader (MalwareBazaar Abuse.ch)

REQUEST_FOR_QUOTATION_25117_2026.arj.zip Sample

modified 2026-10-14 16:15:08
Guloader (Triage) · RemcosRAT (MalwareBazaar Abuse.ch)

Detalles_de_los_recibos_de_pago-5656777878889.tar.rar Sample

modified 2026-10-14 15:56:41
GuLoader (MalwareBazaar Abuse.ch) · Vipkeylogger (Triage)

004922_MT103_001_rejection_000223376.tar Sample

modified 2026-10-14 15:39:57
GuLoader (MalwareBazaar Abuse.ch)

004922_MT103_001_rejection_000223376.exe Sample

modified 2026-10-14 15:39:40
GuLoader (MalwareBazaar Abuse.ch)

New-order35242637337.tar Sample

modified 2026-10-14 15:37:27
GuLoader (MalwareBazaar Abuse.ch)

Request_for_Quotation_-_September_2026.zip Sample

modified 2026-10-14 15:16:52
GuLoader (MalwareBazaar Abuse.ch)

20260916-000581.tar Sample

modified 2026-10-14 15:16:21
GuLoader (MalwareBazaar Abuse.ch)

CRDXX04-06-2026XX-2.50XMM.zip Sample

modified 2026-10-14 15:13:35
GuLoader (MalwareBazaar Abuse.ch)

14102026_1307_12102026_INV.#80619413.gz Sample

modified 2026-10-14 13:07:41
Guloader (Triage)

jaffacakes118_Trojan.Win32.VBKryjetor.baty.70e12e745fbfe08a6fcbe155a2d1086c Sample

modified 2026-10-14 10:41:31
Guloader (Triage)

5957526c321736bd8d3ca004228ca8da8c156f40b02f4312daa77cb3b88edd71 Sample

modified 2026-10-13 11:12:38
Guloader (Triage)

IMG46375758375835Slangebiddenes213.7z Sample

modified 2026-10-13 02:16:39
GuLoader (MalwareBazaar Abuse.ch) · Guloader (Triage)

rPO-086979-CIF-012-2026-Supply.com Sample

modified 2026-10-12 23:25:05
GuLoader (MalwareBazaar Abuse.ch) · GUIDLOADER (ThreatFox Abuse.ch)

PURCHASE INQUIRY DAEP-DWCESTUAELT-9771 [EXPANSION PROJECT].rar Sample

modified 2026-10-12 14:33:24
Guloader (Triage)

PURCHASE INQUIRY DAEP-DWCESTUAELT-9771 EXPANSION PROJECT.vbs Sample

modified 2026-10-12 13:15:05
Guloader (Triage) · GuLoader (MalwareBazaar Abuse.ch)

jaffacakes118_Trojan.Win32.Chapak.docc.237f250f3523983ce15f07e67b30b818 Sample

modified 2026-10-12 10:27:45
Guloader (Triage)

jaffacakes118_Trojan-Spy.Win32.Noon.wzy.94ebd819ff64a76e927a5801062d0c25 Sample

modified 2026-10-12 09:58:39
Guloader (Triage)

RFQ_6000412697.vbe Sample

modified 2026-10-12 09:00:42
GuLoader (MalwareBazaar Abuse.ch) · Remcos (Triage)

Dallyingly.vbe Sample

modified 2026-10-12 09:00:37
GuLoader (MalwareBazaar Abuse.ch) · Guloader (Triage)

Titelren.vbe Sample

modified 2026-10-12 09:00:34
GuLoader (MalwareBazaar Abuse.ch) · Guloader (Triage)

scan.vbe Sample

modified 2026-10-12 09:00:33
GuLoader (MalwareBazaar Abuse.ch) · Guloader (Triage)

INVOICE LIN2609644.vbe Sample

modified 2026-10-12 09:00:29
GuLoader (MalwareBazaar Abuse.ch) · Guloader (Triage)

PO-ADT26_0084.pdf.vbe Sample

modified 2026-10-12 09:00:27
GuLoader (MalwareBazaar Abuse.ch) · Remcos (Triage)

615723-Purchase Contract-261010.vbe Sample

modified 2026-10-12 09:00:26
GuLoader (MalwareBazaar Abuse.ch) · Suspicious Sample (Triage)

NEW RFQ # 6200471116.vbe Sample

modified 2026-10-12 09:00:25
GuLoader (MalwareBazaar Abuse.ch) · Guloader (Triage)

PO SGN260529193TONG HONG TANNERY (VIETNAM).vbs Sample

modified 2026-10-12 08:15:07
Guloader (Triage) · RemcosRAT (MalwareBazaar Abuse.ch)

jaffacakes118_Trojan-PSW.Win32.Fareit.dudd.be0697e413302709e9f85eabf42f18b3 Sample

modified 2026-10-12 07:03:37
Guloader (Triage)

CICU3023855.vbe Sample

modified 2026-10-12 06:19:38
GuLoader (MalwareBazaar Abuse.ch)

pb-xt.com Hostname

modified 2026-10-12 05:02:06
Guloader (Cyber Threat Alliance)

ae8b8a4e7304229fa2bdb355d441005bdf7c15f8678c2329bf7570de1a8a5ac2 Sample

modified 2026-10-12 01:56:49
Guloader (Triage)

Payment Advice.vbe Sample

modified 2026-10-11 17:43:05
GuLoader (MalwareBazaar Abuse.ch)

TAG000006678.vbe Sample

modified 2026-10-11 17:42:55
GuLoader (MalwareBazaar Abuse.ch)

035cca1ee500852ef7fda67e60c373ed2a57756c5fefa60ba7a05aae5b9021ab Sample

modified 2026-10-11 15:37:17
Guloader (Cyber Threat Alliance)

http://pb-xt.com/tyu_JBoUn116.bin URL

modified 2026-10-11 15:37:17
Guloader (Cyber Threat Alliance)

11102026_1318_08102026_PE-AGE INŽINJERING 35644 Nacrt projekta.bat.rar Sample

modified 2026-10-11 13:18:49
Guloader (Triage)

8ef7005cf386f458ca566ed25b6c6f76ba8c299b803b232545e1dfb96f7ad165 Sample

modified 2026-10-11 09:48:32
GuLoader (Cyber Threat Alliance)

11102026_0741_09102026_Poslovne novine d.o.o Ugovor E-746 Nacrt projekta.bat.rar Sample

modified 2026-10-11 07:41:16
Guloader (Triage)

11102026_0731_09102026_SKM_300i26100517080 DRAFT SUPPLY.bat.rar Sample

modified 2026-10-11 07:31:25
Guloader (Triage)

PO_05964_pdf.exe Sample

modified 2026-10-11 05:37:35
GuLoader (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

185.225.73.165 IPv4

modified 2026-10-11 05:04:19
Guloader (Cyber Threat Alliance)

6721d6b0ed68abe2669a5e8cb5b5c2c56e6388db7c643619c14bd8436aa255e1.exe Sample

modified 2026-10-11 04:41:37
Generic Malware (Hybrid-Analysis) · Guloader (Triage)

10092026_1524_08092026_Pendaftaran Lembur September 2026.vbe.rar Sample

modified 2026-10-11 01:31:07
Guloader (Triage)

025f527cfdd806509c6bdbd4251f81586a6731498a68d82064525dba734920cb.exe Sample

modified 2026-10-10 16:16:46
GuLoader (MalwareBazaar Abuse.ch) · SigLoader (ThreatFox Abuse.ch) · Generic Malware (Hybrid-Analysis) · Guloader (Triage)

3d0fd0444a9e295135ecfdc8c87ddc6dcdff63969c745e0218469332aef18dfe Sample

modified 2026-10-10 15:32:48
Guloader (Cyber Threat Alliance)

http://185.225.73.165/download/KFlCDkfoA181.sea URL

modified 2026-10-10 15:32:48
Guloader (Cyber Threat Alliance)

jaffacakes118_Trojan-PSW.Win32.Fareit.edau.b5596a1305cf32473eb19e9a0fa7e731 Sample

modified 2026-10-10 12:39:19
Guloader (Triage)

jaffacakes118_Trojan-PSW.Win32.Fareit.eblj.2c2ab06be7e1a7756c97c749740526b4 Sample

modified 2026-10-10 12:38:22
Guloader (Triage)

jaffacakes118_Trojan-PSW.Win32.Fareit.eaqm.e66d9191ed0cbf39ce554dc699efb8c1 Sample

modified 2026-10-10 12:38:04
Guloader (Triage)

Payment Advice.vbs Sample

modified 2026-10-10 03:31:59
GuLoader (MalwareBazaar Abuse.ch)

F_64487-semnat.rar Sample

modified 2026-10-10 00:23:04
Guloader (Triage)

TransferenciaXrecibo-X18108714.rar Sample

modified 2026-10-10 00:03:16
GuLoader (MalwareBazaar Abuse.ch)

4e7757f18ae0c6aeac44ed49de53657e81d46474c75c431b291e3e5712b94045 Sample

modified 2026-10-09 15:40:48
Guloader (Cyber Threat Alliance)

PE-AGE INŽINJERING Ponuda Nacrt projekta.vbs Sample

modified 2026-10-09 15:02:04
GuLoader (MalwareBazaar Abuse.ch)

fbcbfa3bae2c721a8923ef296e7f7140d3035a2cf711ab3df4d948eba6226446 Sample

modified 2026-10-09 07:36:16
GUIDLOADER (ThreatFox Abuse.ch) · GuLoader (MalwareBazaar Abuse.ch)

SHIPMENT_ARRIVAL_NOTICE#423-XXX.exe Sample

modified 2026-10-09 06:14:39
GuLoader (Abuse.ch)

TiSi_Use_Equipment_List.zip Sample

modified 2026-10-09 05:58:16
GuLoader (Abuse.ch)

TWI-SHA 202102.exe Sample

modified 2026-10-09 05:29:34
GuLoader (Abuse.ch)

PURCHASE ORDER.exe Sample

modified 2026-10-09 05:15:11
GuLoader (Abuse.ch)