🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd136f5f464244be32e5443c06dda5e78f0b6c49ef566232ce680f4402429cb8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


GuLoader


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd136f5f464244be32e5443c06dda5e78f0b6c49ef566232ce680f4402429cb8
SHA3-384 hash: fe3a99306f441d81c1f57c6dac424c90f56062673c3290eaac54a3b0da2ed5bf5b2a5bd47466f10c9703da2491d4721e
SHA1 hash: f51a515beb1c4f6bbde6f2a60d62fa5df7b498ad
MD5 hash: a958e7535e035e1963c7586dab036853
humanhash: bacon-early-fix-michigan
File name:Conferma di pagamento.exe
Download: download sample
Signature GuLoader
Create hunting rule
File size:855'720 bytes
First seen:2025-10-20 12:29:46 UTC
Last seen:2025-11-06 10:22:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3abe302b6d9a1256e6a915429af4ffd2 (299 x GuLoader, 39 x Formbook, 25 x Loki)
ssdeep 12288:MagM77ZqgnvYFX698r3+wU2GMku9M+ZamHPKMnfDU9sB5PSi96Pd2o0VY8RNzkXK:W87ZaLUepL8bMfDUOBNSivHGw4X7y3l
TLSH T1840523132695D02AE74A09B45822FF39C3B5FC781E1C4B979BD07FBB7E921463E02582
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 96b2fcf6f6acb234 (2 x GuLoader)
Reporter lowmal3
Tags:exe GuLoader signed

Code Signing Certificate

Organisation:Monadnock
Issuer:Monadnock
Algorithm:sha256WithRSAEncryption
Valid from:2025-08-23T08:41:18Z
Valid to:2026-08-23T08:41:18Z
Serial number: 05dbc03fa271d768f8ec4a028f4d879f601d0f56
Thumbprint Algorithm:SHA256
Thumbprint: 4bfbb8b137aafe09d5effe2e75af0e4124c28b079013ffcca33d450274cdb440
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
178
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Conferma di pagamento.exe
Verdict:
Malicious activity
Analysis date:
2025-10-13 14:36:57 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ec9bf62b-ade0-4caa-aba9-3abf7890426e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/33432/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68f62b416dc4a08515e375dd
Tags:
injection obfusc virus nsis
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Using the Windows Management Instrumentation requests
Launching a process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole installer microsoft_visual_cc nsis overlay signed
Link:
https://www.filescan.io/uploads/68f62b9e11ff3db29f64684b/reports/6135d392-b9d7-4522-a21b-9ddc956d089f/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/cd136f5f464244be32e5443c06dda5e78f0b6c49ef566232ce680f4402429cb8
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-13T03:05:00Z UTC
Last seen:
2025-10-22T08:44:00Z UTC
Hits:
~1000
Detections:
Backdoor.Androm.HTTP.Download Trojan-Downloader.Win32.Minix.sb Trojan.Win32.Inject.sb Trojan.Win32.Guloader.sb Trojan.Makoob.HTTP.C&C Trojan.NSIS.Makoob.sba HEUR:Trojan.Win32.Makoob.gen HEUR:Backdoor.Win32.Androm.gen VHO:Trojan.NSIS.Makoob.gen VHO:Backdoor.Win32.Androm.gen
Link:
https://opentip.kaspersky.com/cd136f5f464244be32e5443c06dda5e78f0b6c49ef566232ce680f4402429cb8/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/44043274-0e5c-4990-8bc9-b2a272abf43e
Result
Threat name:
AgentTesla, GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1798293
Signature
AI detected suspicious PE digital signature
Antivirus detection for URL or domain
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Early bird code injection technique detected
Found suspicious powershell code related to unpacking or dynamic code loading
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected GuLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1798293 Sample: Conferma di pagamento.exe Startdate: 20/10/2025 Architecture: WINDOWS Score: 100 24 mail.dongjln.com 2->24 26 ip-api.com 2->26 28 dongjln.com 2->28 36 Suricata IDS alerts for network traffic 2->36 38 Antivirus detection for URL or domain 2->38 40 Multi AV Scanner detection for dropped file 2->40 42 6 other signatures 2->42 8 Conferma di pagamento.exe 1 53 2->8         started        signatures3 process4 process5 10 powershell.exe 30 8->10         started        file6 20 C:\Users\user\...\Conferma di pagamento.exe, PE32 10->20 dropped 22 Conferma di pagame...exe:Zone.Identifier, ASCII 10->22 dropped 44 Early bird code injection technique detected 10->44 46 Writes to foreign memory regions 10->46 48 Found suspicious powershell code related to unpacking or dynamic code loading 10->48 50 4 other signatures 10->50 14 msiexec.exe 15 8 10->14         started        18 conhost.exe 10->18         started        signatures7 process8 dnsIp9 30 ip-api.com 208.95.112.1, 49697, 80 TUT-ASUS United States 14->30 32 dongjln.com 146.70.118.226, 49698, 49699, 49700 TENET-1ZA United Kingdom 14->32 34 172.245.209.158, 49696, 80 AS-COLOCROSSINGUS United States 14->34 52 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 14->52 54 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 14->54 56 Tries to steal Mail credentials (via file / registry access) 14->56 58 4 other signatures 14->58 signatures10
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cd136f5f464244be32e5443c06dda5e78f0b6c49ef566232ce680f4402429cb8
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/a958e7535e035e1963c7586dab036853
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd136f5f464244be32e5443c06dda5e78f0b6c49ef566232ce680f4402429cb8/
Verdict:
Malicious
Threat:
VHO:Backdoor.Win32.Androm
Link:
https://tip.neiki.dev/file/cd136f5f464244be32e5443c06dda5e78f0b6c49ef566232ce680f4402429cb8
Threat name:
Win32.Trojan.GuLoader
Create hunting rule
Status:
Malicious
First seen:
2025-10-13 12:47:04 UTC
File Type:
PE (Exe)
Extracted files:
32
AV detection:
21 of 36 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zujw6x2gijcl4mxfiq6anxnf46hqw3cj55lgemwonahuiascts4a._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla discovery execution installer keylogger spyware stealer trojan
Link:
https://tria.ge/reports/251020-pptd2atlap/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Badlisted process makes network request
Looks up external IP address via web service
AgentTesla
Agenttesla family
Unpacked files
SH256 hash:
062c75ad650548750564ffd7aef8cd553773b5c26cae7f25a5749b13165194e3
MD5 hash:
eac1c3707970fe7c71b2d760c34763fa
SHA1 hash:
f275e659ad7798994361f6ccb1481050aba30ff8
Link:
https://www.unpac.me/results/c1af8d03-01c0-4759-9afd-63f329d46e5e/
SH256 hash:
a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
MD5 hash:
b0c77267f13b2f87c084fd86ef51ccfc
SHA1 hash:
f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
Link:
https://www.unpac.me/results/c1af8d03-01c0-4759-9afd-63f329d46e5e/
SH256 hash:
cd136f5f464244be32e5443c06dda5e78f0b6c49ef566232ce680f4402429cb8
MD5 hash:
a958e7535e035e1963c7586dab036853
SHA1 hash:
f51a515beb1c4f6bbde6f2a60d62fa5df7b498ad
Link:
https://www.unpac.me/results/c1af8d03-01c0-4759-9afd-63f329d46e5e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cd136f5f464244be32e5443c06dda5e78f0b6c49ef566232ce680f4402429cb8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

GuLoader

Executable exe cd136f5f464244be32e5443c06dda5e78f0b6c49ef566232ce680f4402429cb8

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/33432/

Comments