GuLoader

GuLoader is a file downloader that has been used since at least December 2019 to distribute a variety of remote administration tool (RAT) malware, including NETWIRE, Agent Tesla, NanoCore, FormBook, and Parallax RAT.

4New IOCs · 24h

23New IOCs · 7 days

24Indicators tracked

3Independent feeds

2026-10-12 06:19Last activity

New indicators per day

2026-09-29 to 2026-10-12, by first report.

Hash23
TLS cert1
Malware23
C21

MITRE ATT&CK lists this as malware GuLoader. Explore the ATT&CK matrix →

Where its infrastructure is hosted

No location data.

Latest indicators

Filter the live feed →

First seen	Type	Indicator	Role	Where
2026-10-12 06:19	SHA256	653951f4b2a8a86bf938ea67c2a513ea8d72a1b4fcb996335767e02533a5de83	Malware sample	—
2026-10-12 06:00	SHA256	f7b3bdc1a0430b183dd9d8503c4fb042af8bb300bb3ee17bff63e668fab58a9a	Malware sample	—
2026-10-11 17:43	SHA256	749211ff7d7c1be6b5393c5d94dcb04347d9f4cc7550dccaf787757ee48d1ce9	Malware sample	—
2026-10-11 17:42	SHA256	697eed9cdb0e01ff7bdec200f32e6ed3869d6819044d6941d35a1600310e2dc9	Malware sample	—
2026-10-11 05:39	SHA256	37526ab8124c87e50c5772f30220af97d738f649b8ff8fc95e68b746df20fd30	Malware sample	—
2026-10-10 14:26	SHA256	883ec8f4371547d297895632d59ccd2e50ad1826f6cc47d09873390a53393344	Malware sample	—
2026-10-10 12:40	SHA256	79be0ca16e1aaf7a55b1eaf269991d6399661bf384e07edb61d292f1ad115fd3	Malware sample	—
2026-10-09 15:02	SHA256	f01762095f277a17938ea98707098c5601022c46d32ccc5391c345e4b87f5afb	Malware sample	—
2026-10-09 15:02	SHA256	226bc953ea4629310a9e8e9d811819a1a5def391789b1b90e873b8640c7a78c9	Malware sample	—
2026-10-09 11:55	SHA256	729ef8e6a3cf1859811f3010b514416231e92ca66c4817cf8d6fce9df427a6a8	Malware sample	—
2026-10-09 04:17	SHA256	8fdc95720a0efe3f6be3bddbbd00d04eb710aea4672d5c41527b0315dfcc6fe2	Malware sample	—
2026-10-09 02:47	SHA256	91c7e792bf1faf9143d70ecb994a99d37ea9c2ae1d47c93c66a14346172841df	Malware sample	—
2026-10-09 02:47	SHA256	f6d217eef5f7c12c4ee00d36809b2e4ad57a1893863daf4423f318e6f3c7f06b	Malware sample	—
2026-10-07 18:04	SHA256	2117f5970b0c2e54d8f453817cadb4955ec50e77116ae6e25e8abe8afc0dc1c0	Malware sample	—
2026-10-07 17:59	SHA256	4a6f0914a45de901e91b1b622180ae2c71d7e29196a798f5fe53abf9230301a2	Malware sample	—
2026-10-07 17:59	SHA256	75b5ac08a089cdf2127514e4cea9f861f3a048cfb9c6f130fcf13a1f16573af4	Malware sample	—
2026-10-07 17:59	SHA256	3d2cfe279b8e0be0bbf025525cb03fcbf33a0820cfb9c1aa835017fdbe4534a1	Malware sample	—
2026-10-07 17:59	SHA256	a7937c1d521825e89a8fdc26146292370c73bbd39d04b0ca79d07589a4a0a972	Malware sample	—
2026-10-07 11:09	SHA256	f383eb80238916fd6c00c1513464f841fefb622aad04f345f4bc69f8a24aa8b1	Malware sample	—
2026-10-07 06:55	SHA256	002bcfbdd6eea1b72fecccd951b3a2db7d6bb7b810bb1495182002de40d4988e	Malware sample	—
2026-10-06 22:34	SHA256	03590a1a4a3a50834691ff36b8d0542a8ed247ff3df156f777236937f82daf87	Malware sample	—
2026-10-06 16:58	SHA256	0f4e5414e616638a2b39d3fbd961ad4d38cd2fca15fab88ffa4583858b216d98	Malware sample	—
2026-10-06 04:23	SHA256	b6372c69f32a81e9a73134d72f0c907ff62ac19410b0dab70aab3b317305cbd4	Malware sample	—
2020-06-06 17:51	TLS cert	32f24b2194785f9696491154f2d1b5b0e170d0bb	Botnet C2	—

Defanged for safety. URL query strings removed.

New indicators per day

Where its infrastructure is hosted

Latest indicators

Security check