ThreatFox: GUIDLOADER IOCs

Hunt Hypothesis

This hunt targets the presence of specific IOCs associated with the GUIDLOADER malware, which adversaries deploy to establish persistence and execute payloads within the environment. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised assets early, potentially disrupting the attacker’s post-exploitation activities before they escalate privileges or exfiltrate data.

IOC Summary

Malware Family: GUIDLOADER Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`3a0e80415e7e1f49ee3bd7912832f3c0`	payload	2026-09-11	95%
sha256_hash	`51484aa565b674d5b92d1cccb0f8d86378c1c40ee3b321d2f6b5e192af200458`	payload	2026-09-11	95%
sha1_hash	`b3233de7e91adf25c6dddecdaffc1eb6d2e6b43b`	payload	2026-09-11	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - GUIDLOADER
let malicious_hashes = dynamic(["3a0e80415e7e1f49ee3bd7912832f3c0", "51484aa565b674d5b92d1cccb0f8d86378c1c40ee3b321d2f6b5e192af200458", "b3233de7e91adf25c6dddecdaffc1eb6d2e6b43b"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — GUIDLOADER

False Positive Guidance

Legacy Application Deployment via MSI/EXE Installers: The GUIDLOADER IOCs often include specific file hashes or paths associated with older, unpatched versions of enterprise software (e.g., legacy Java JRE components, specific versions of Adobe Reader, or old .NET Framework redistributables) that are still deployed across the estate.
- Filter/Exclusion: Exclude known vendor installation directories (e.g., C:\Program Files\Java\jre1.8.0_..., C:\Program Files\Adobe\...) and allowlist specific SHA256 hashes of the legitimate installer binaries or the resulting DLLs if they match the vendor’s official build.
Scheduled Maintenance Jobs for Third-Party Utilities: Administrative scheduled tasks (e.g., Task Scheduler jobs for tools like 7-Zip, WinRAR, or specific database backup utilities) may execute binaries that share the same file name or path structure as the GUIDLOADER IOCs, particularly if the tool is installed in a non-standard location like C:\Tools\ or C:\Admin\.
- Filter/Exclusion: Correlate the alert with the parent process being svchost.exe (specifically the Task Scheduler service) or explorer.exe (if user-initiated), and verify the binary’s digital signature matches the expected vendor (e.g., Igor Pavlov for 7-Zip, WinRAR for WinRAR).
Development and QA Environments: Developers and QA engineers frequently download and run specific versions of testing frameworks, mock servers, or old SDKs for compatibility testing. These artifacts may reside in user profile directories (C:\Users\<dev>\AppData\Local\... or C:\Users\<dev>\Projects\...) and match the IOC paths or hashes.
- *Filter