Extracted

• • Target

    c92791b7719c410885432385c668313a7e75d9ce152bab6192ba4d657ef052eb

  • Size

    236KB

  • MD5

    0af9899535e4e01ca5f462698b4daf76

  • SHA1

    b45e55bb808b2d6474948751d6e5222dd1681f25

  • SHA256

    c92791b7719c410885432385c668313a7e75d9ce152bab6192ba4d657ef052eb

  • SHA512

    a8083a5daabddb4882beaaf94ce6cc984db46900610161cde796ef7e0341ee1cb7ab59947b06401336a00a64016e5dde8f75f71953a873c7da2ba3a1526ddc59

  • SSDEEP

    6144:NdEW6JwLKqkYUogiOi7iiviii2lALi+i9iiai1iiqiriiBiSiiPiiiifkEM6r:QW

  Score

  10^/10

  guloaderdownloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2