MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4dcd18358a0d573b8aa891048537c0b4bad8a7a7cdd4bd39e4114a2367c3bf82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
GuLoader
Vendor detections: 8
| SHA256 hash: | 4dcd18358a0d573b8aa891048537c0b4bad8a7a7cdd4bd39e4114a2367c3bf82 |
|---|---|
| SHA3-384 hash: | df589422267ca460ae3652da1b83c439df5a47a745b859aa258168be5d40fe058440736ece7464d6150b6a3182a61451 |
| SHA1 hash: | 94e502480e135a6780ed0b0f44cc623c70df8663 |
| MD5 hash: | ee5b2f7b41494ae7c08262467fdc1133 |
| humanhash: | fish-kilo-zulu-angel |
| File name: | ΣΥΜΒΟΛΑΙΟ DEV8759-pdf.exe |
| Download: | download sample |
| Signature | GuLoader |
| File size: | 608'808 bytes |
| First seen: | 2024-04-17 13:22:27 UTC |
| Last seen: | 2024-04-17 14:36:14 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 59a4a44a250c4cf4f2d9de2b3fe5d95f (70 x GuLoader, 13 x AgentTesla, 7 x AZORult) |
| ssdeep | 12288:49HJa4S9Q+RK59LYUaxfVSYmhzLKCx57zTE8fCtj8TQBEiOmg4njc:49HJabQjbLYxVSYgLBx57M8q8TQBNOmW |
| Threatray | 498 similar samples on MalwareBazaar |
| TLSH | T1C5D4F12667968C43F2D905B493B3E37877359D942A1B8212A6F1FF6B782C3C15E3D242 |
| TrID | 92.7% (.EXE) NSIS - Nullsoft Scriptable Install System (846567/2/133) 3.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 1.1% (.EXE) Win64 Executable (generic) (10523/12/4) 0.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 0.5% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| File icon (PE): |  |
| dhash icon | c8cc5c7efcdc8a00 (4 x GuLoader, 2 x AgentTesla) |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader signed |
Code Signing Certificate
| Organisation: | Merskumspiben |
|---|---|
| Issuer: | Merskumspiben |
| Algorithm: | sha256WithRSAEncryption |
| Valid from: | 2023-06-05T10:47:08Z |
| Valid to: | 2026-06-04T10:47:08Z |
| Serial number: | 2d8240a66976c31576d0d69df392828cbfbd6dc9 |
| Thumbprint Algorithm: | SHA256 |
| Thumbprint: | b8bed8617c3eb760277b5da4571f431afe397f66816a2bc053c734aedcea6fc3 |
| Source: | This information was brought to you by ReversingLabs A1000 Malware Analysis Platform |
Intelligence
File Origin
# of uploads :
2
# of downloads :
338
Origin country :
NLVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4dcd18358a0d573b8aa891048537c0b4bad8a7a7cdd4bd39e4114a2367c3bf82.exe
Verdict:
Malicious activity
Analysis date:
2024-04-17 13:30:25 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Creating a window
Launching a process
Moving a file to the Program Files subdirectory
Replacing files
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Verdict:
Unknown
Result
Threat name:
GuLoader, Discord Token Stealer
Detection:
malicious
Classification:
troj.evad.spyw
Score:
88 / 100
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Discord Token Stealer
Yara detected GuLoader
Behaviour
Behavior Graph:
n/a
Score:
96%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.Guloader
Status:
Malicious
First seen:
2024-04-17 05:27:08 UTC
File Type:
PE (Exe)
Extracted files:
50
AV detection:
13 of 38 (34.21%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 488 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Enumerates physical storage devices
Unpacked files
SH256 hash:
484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
MD5 hash:
960a5c48e25cf2bca332e74e11d825c9
SHA1 hash:
da35c6816ace5daf4c6c1d57b93b09a82ecdc876
SH256 hash:
f4530c734e3ce6253ffa6e5d755d61e4709ab9fc3b0eee3d4cdb89ec89c48bd2
MD5 hash:
aea3ac67fa68fd3f00edfbf9b43a2770
SHA1 hash:
aa59d1a4311c42b612ee66a027f224261beebbc3
SH256 hash:
495bddc0be6e18e981db82fab9d1de55c7e269ab4ec3ff43035193bc017a307b
MD5 hash:
8ced0b79f7b9033d0795aab3be6d627c
SHA1 hash:
90c2043ffccd068f407c624c50ac7b795db1e132
SH256 hash:
dd4e24bcee7e9e952f1c7cda7532c0b851b87577e1b679380808f22d875c7c96
MD5 hash:
c430c0a7ef0ac8f80004de7f7898bced
SHA1 hash:
1f698e988bcc19d280a70c3283ff2816bb0db465
SH256 hash:
4dcd18358a0d573b8aa891048537c0b4bad8a7a7cdd4bd39e4114a2367c3bf82
MD5 hash:
ee5b2f7b41494ae7c08262467fdc1133
SHA1 hash:
94e502480e135a6780ed0b0f44cc623c70df8663
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Detect_SliverFox_String |
|---|---|
| Author: | huoji |
| Description: | Detect files is `SliverFox` malware |
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| COM_BASE_API | Can Download & Execute components | ole32.dll::CoCreateInstance |
| SHELL_API | Manipulates System Shell | SHELL32.dll::ShellExecuteA SHELL32.dll::SHFileOperationA SHELL32.dll::SHGetFileInfoA |
| WIN32_PROCESS_API | Can Create Process and Threads | KERNEL32.dll::CreateProcessA KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread |
| WIN_BASE_API | Uses Win Base API | KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryExA KERNEL32.dll::GetDiskFreeSpaceA KERNEL32.dll::GetCommandLineA |
| WIN_BASE_IO_API | Can Create Files | KERNEL32.dll::CopyFileA KERNEL32.dll::CreateDirectoryA KERNEL32.dll::CreateFileA KERNEL32.dll::DeleteFileA KERNEL32.dll::MoveFileA KERNEL32.dll::GetWindowsDirectoryA |
| WIN_REG_API | Can Manipulate Windows Registry | ADVAPI32.dll::RegCreateKeyExA ADVAPI32.dll::RegDeleteKeyA ADVAPI32.dll::RegOpenKeyExA ADVAPI32.dll::RegQueryValueExA ADVAPI32.dll::RegSetValueExA |
| WIN_USER_API | Performs GUI Actions | USER32.dll::AppendMenuA USER32.dll::EmptyClipboard USER32.dll::FindWindowExA USER32.dll::OpenClipboard USER32.dll::PeekMessageA USER32.dll::CreateWindowExA |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.