Extracted

• • Target

    a8d7125654cc5dddae64e1aed9332df766ba871140fcb3d2ff5862308ba75df9

  • Size

    140KB

  • MD5

    d1aea2257336cf89aa6281bce28966a7

  • SHA1

    2f21a197ae47429ac8be720ff7064b6c93a9cbdd

  • SHA256

    a8d7125654cc5dddae64e1aed9332df766ba871140fcb3d2ff5862308ba75df9

  • SHA512

    822106b356dc0cb79a6aaca63e2c6601a373a94c9b9728aa08fedea7c9837ad9c7a821f512d284c6d1916bbfc8ee69b3fd421c8e08f5da0802be1278cf5506ef

  • SSDEEP

    1536:xWWTwV4fVhuOOmEQjR0a5zpzquiScAWPQcClRfpuxVQwV4MjW:VwVUPXTEQjGa5FdoAWepQqwV

  Score

  10^/10

  guloaderdownloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2