🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1dcab56a0998fc7228c2ec8ef6a4e9721522a9fa94a2665ed12d63d721db5b23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1dcab56a0998fc7228c2ec8ef6a4e9721522a9fa94a2665ed12d63d721db5b23
SHA3-384 hash: 442b1eb4ecc27ac590e3aa4274fa7325264fa5071b33a48101ead1475413f5cca3fe021be15b16c83901e30fcdb00427
SHA1 hash: 4c6a30b5cc364794adfc784ccace3b3554aaf0b0
MD5 hash: 8561d43ac49e66be78afd688f68d0048
humanhash: blossom-failed-jig-skylark
File name:1dcab56a0998fc7228c2ec8ef6a4e9721522a9fa94a2665ed12d63d721db5b23
Download: download sample
Signature GuLoader
Create hunting rule
File size:404'685 bytes
First seen:2026-03-06 15:36:21 UTC
Last seen:2026-04-07 18:36:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4ea4df5d94204fc550be1874e1b77ea7 (254 x GuLoader, 32 x RemcosRAT, 26 x VIPKeylogger)
ssdeep 6144:nwq3NpGrARcVC0Fw5NQqVkCrpgF2d33IxSLoMn36/3ACxtcEmb:nzSicVXoNSCrp0OxsGyx98
TLSH T17A8412027AC2C047CA9609B00CB1FB73E6A97D5C69568743B792BF0CF672655A84D3B3
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon c5e0ba8889c9cc0c (2 x GuLoader, 1 x RemcosRAT, 1 x PhantomStealer)
Reporter adrian__luca
Tags:exe GuLoader

Intelligence

File Origin
# of uploads :
3
# of downloads :
152
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
GuLoader NSIS
Details
GuLoader
a c2 URL, a useragent string, and a string XOR key
GuLoader
an XOR decryption key and an extracted component
NSIS
extracted archive contents
Link:
https://research.acce.ciphertechsolutions.com/results/c8b3a220-621a-43aa-8e19-829cc4737da0/
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
1dcab56a0998fc7228c2ec8ef6a4e9721522a9fa94a2665ed12d63d721db5b23
Verdict:
Malicious activity
Analysis date:
2026-03-06 17:04:19 UTC
Tags:
stealer evasion ftp agenttesla exfiltration
Link:
https://app.any.run/tasks/ee23b7f0-96be-4db5-890e-7cc0822c6bac

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/56385/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader49.35354.15501.8080.UNOFFICIAL
Create hunting rule

Gathering data
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/1dcab56a0998fc7228c2ec8ef6a4e9721522a9fa94a2665ed12d63d721db5b23
Verdict:
Malicious
File Type:
exe x32
Link:
https://opentip.kaspersky.com/1dcab56a0998fc7228c2ec8ef6a4e9721522a9fa94a2665ed12d63d721db5b23/results?tab=lookup
Malware family:
NSIS
Create hunting rule
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6ed1b04d-65f5-4864-af43-7adb0989fa2c
Score:
76%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1dcab56a0998fc7228c2ec8ef6a4e9721522a9fa94a2665ed12d63d721db5b23
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1dcab56a0998fc7228c2ec8ef6a4e9721522a9fa94a2665ed12d63d721db5b23/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Suspicious
First seen:
2026-02-25 11:08:34 UTC
File Type:
PE (Exe)
Extracted files:
20
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dxflk2qjtd6hekgc5shpnjhjoiksfkp2ssrgmxwrfvr5oio3lmrq._file
Result
Malware family:
guloader
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:guloader discovery downloader keylogger spyware stealer trojan
Link:
https://tria.ge/reports/260306-s1784sbw7x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Contacts third-party web service commonly abused for C2
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Agenttesla family
Guloader family
Guloader,Cloudeye
Unpacked files
SH256 hash:
1dcab56a0998fc7228c2ec8ef6a4e9721522a9fa94a2665ed12d63d721db5b23
MD5 hash:
8561d43ac49e66be78afd688f68d0048
SHA1 hash:
4c6a30b5cc364794adfc784ccace3b3554aaf0b0
Link:
https://www.unpac.me/results/60034d09-9f72-4324-b3e8-0c0f699c5e1c/
SH256 hash:
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 hash:
17ed1c86bd67e78ade4712be48a7d2bd
SHA1 hash:
1cc9fe86d6d6030b4dae45ecddce5907991c01a0
Link:
https://www.unpac.me/results/60034d09-9f72-4324-b3e8-0c0f699c5e1c/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1dcab56a0998/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/56385/

Comments