🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 742a3d5507a8c131f0e6a0bffd2416ee20377dfbefa348fafd5271dec07f9ef9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 18


Intelligence 18 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 742a3d5507a8c131f0e6a0bffd2416ee20377dfbefa348fafd5271dec07f9ef9
SHA3-384 hash: 39829babae7751dacf9bb1cb84d0545ac023a8557683cbddba0a9579fef2264d85d5633ba1e7808504b55aa5bd909796
SHA1 hash: b7471c8768f9f901851a1dc67b78972181bf1ddb
MD5 hash: c2b99cc29e11149554be75b3ad86da71
humanhash: jersey-cola-kansas-table
File name:Ordini200394857615122025.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:477'352 bytes
First seen:2025-12-15 08:20:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 744 x AgentTesla, 443 x GuLoader)
ssdeep 6144:TYa6vDKzm0n+DcWPBu6Vnv6UQOcdT6Wgio5EVxBUnFQhkWeDMLoX+dRvLiqZewXi:TYBDKzdnbQnvrc15giV5hkRiTPFOJL
TLSH T128A412D17550D066E5A687700D7B85E71AB1AC26BCB4C34F33A2BFAD3F73294822A315
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 70cc86b2968e8c30 (6 x GuLoader, 3 x PhantomStealer, 2 x VIPKeylogger)
Reporter lowmal3
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:Ziads
Issuer:Ziads
Algorithm:sha256WithRSAEncryption
Valid from:2025-12-11T02:15:50Z
Valid to:2026-12-11T02:15:50Z
Serial number: 4d889cda6ba36d4a7cf70f19b9a3ac3b87bdf392
Thumbprint Algorithm:SHA256
Thumbprint: bbedae71a41f59b890a72db948ff7487d1ecc29285c36727f02cc359cec6d8f5
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
GuLoader NSIS
Details
GuLoader
a c2 URL, a useragent string, and a string XOR key
GuLoader
an XOR decryption key and an extracted component
NSIS
extracted archive contents
Link:
https://research.acce.ciphertechsolutions.com/results/cc7a29df-9d9d-49dd-90cb-5bde74423aa9/
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
_742a3d5507a8c131f0e6a0bffd2416ee20377dfbefa348fafd5271dec07f9ef9.exe
Verdict:
Malicious activity
Analysis date:
2025-12-15 08:26:15 UTC
Tags:
stealer ultravnc rmm-tool evasion agenttesla
Link:
https://app.any.run/tasks/97b9603b-80f6-4846-af4e-5eb3e102b620

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Guloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/44695/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=693fc4cb039c1dfc733960c7
Tags:
n/a
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole installer installer installer-heuristic microsoft_visual_cc nsis overlay signed
Link:
https://www.filescan.io/uploads/693fc4c998941bdf1de60190/reports/894c5926-aa2f-445c-adea-364e249878b0/overview
Verdict:
Malicious
Labled as:
Malware_50.5
Link:
https://www.hybrid-analysis.com/sample/742a3d5507a8c131f0e6a0bffd2416ee20377dfbefa348fafd5271dec07f9ef9
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-15T04:29:00Z UTC
Last seen:
2025-12-17T06:07:00Z UTC
Hits:
~100
Detections:
Trojan-Downloader.Win32.Minix.sb Trojan.Makoob.HTTP.C&C HEUR:Backdoor.Win32.Androm.gen Backdoor.Androm.HTTP.Download Trojan.NSIS.Makoob.sba
Link:
https://opentip.kaspersky.com/742a3d5507a8c131f0e6a0bffd2416ee20377dfbefa348fafd5271dec07f9ef9/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/a5e98336-5951-42de-af10-e62d7bd9bf5d
Result
Threat name:
AgentTesla, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1832800
Signature
AI detected suspicious PE digital signature
Antivirus detection for URL or domain
Check if machine is in data center or colocation facility
Found malware configuration
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Yara detected AgentTesla
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1832800 Sample: Ordini200394857615122025.exe Startdate: 15/12/2025 Architecture: WINDOWS Score: 100 22 mail.dongjln.com 2->22 24 dongjln.com 2->24 26 ip-api.com 2->26 34 Suricata IDS alerts for network traffic 2->34 36 Found malware configuration 2->36 38 Antivirus detection for URL or domain 2->38 40 6 other signatures 2->40 8 Ordini200394857615122025.exe 2 49 2->8         started        signatures3 process4 file5 20 C:\Users\user\AppData\Local\...\System.dll, PE32 8->20 dropped 42 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->42 44 Tries to detect virtualization through RDTSC time measurements 8->44 46 Unusual module load detection (module proxying) 8->46 48 Switches to a custom stack to bypass stack traces 8->48 12 Ordini200394857615122025.exe 15 8 8->12         started        16 Ordini200394857615122025.exe 8->16         started        signatures6 process7 dnsIp8 28 dongjln.com 146.70.118.226, 49727, 49728, 49729 TENET-1ZA United Kingdom 12->28 30 ip-api.com 208.95.112.1, 49726, 80 TUT-ASUS United States 12->30 32 185.29.10.100, 49725, 80 DATACLUB-SE European Union 12->32 50 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->50 52 Tries to steal Mail credentials (via file / registry access) 12->52 54 Tries to harvest and steal ftp login credentials 12->54 56 Tries to harvest and steal browser information (history, passwords, etc) 12->56 18 Ordini200394857615122025.exe 12->18         started        signatures9 process10
Score:
94%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/742a3d5507a8c131f0e6a0bffd2416ee20377dfbefa348fafd5271dec07f9ef9
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/742a3d5507a8c131f0e6a0bffd2416ee20377dfbefa348fafd5271dec07f9ef9/
Verdict:
Malicious
Threat:
Family.AGENTTESLA
Link:
https://tip.neiki.dev/file/742a3d5507a8c131f0e6a0bffd2416ee20377dfbefa348fafd5271dec07f9ef9
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Suspicious
First seen:
2025-12-15 08:21:17 UTC
File Type:
PE (Exe)
Extracted files:
21
AV detection:
15 of 23 (65.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oqvd2vihvdatd4hguc772jaw5yqdo7p356rur6x5kjy55qd7t34q._file
Verdict:
malicious
Label(s):
cloudeye
Create hunting rule
Similar samples:
error
GuLoader
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery keylogger spyware stealer trojan
Link:
https://tria.ge/reports/251215-j8lweatmam/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Looks up external IP address via web service
Loads dropped DLL
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Agenttesla family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5ddb3ddb-d4fc-475a-974c-7b4a5a5c04d7
Unpacked files
SH256 hash:
742a3d5507a8c131f0e6a0bffd2416ee20377dfbefa348fafd5271dec07f9ef9
MD5 hash:
c2b99cc29e11149554be75b3ad86da71
SHA1 hash:
b7471c8768f9f901851a1dc67b78972181bf1ddb
Link:
https://www.unpac.me/results/99a6a911-eb0b-426a-992c-5adf1f3f9dc8/
SH256 hash:
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 hash:
cff85c549d536f651d4fb8387f1976f2
SHA1 hash:
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
Link:
https://www.unpac.me/results/99a6a911-eb0b-426a-992c-5adf1f3f9dc8/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/742a3d5507a8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/742a3d5507a8c131f0e6a0bffd2416ee20377dfbefa348fafd5271dec07f9ef9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe 742a3d5507a8c131f0e6a0bffd2416ee20377dfbefa348fafd5271dec07f9ef9

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/44695/

Comments