Extracted

• • Target

    chrome.exe

  • Size

    583KB

  • MD5

    42ee1ad3b4600a955888780e8899c1ce

  • SHA1

    4ba8b368c32fa57703613e0c98d90381b872d5ad

  • SHA256

    caf073b1d85bc136488382be2c83c264ac64d2df279752341b1c4601c6201a41

  • SHA512

    42063774445da72a55fd97b8a614275993ac7def057efea876e2bafca5a4560c553a450252157a662364e58734d221632547f1e776d7bd8b600ca4c127c03665

  • SSDEEP

    12288:L5Z+mqofs6TaXML3crUlbIInrHR2Fwn6DijBtpl2i6F+0cfjoop:tUJN9MwrfInrHvnY7ipzoop

  Score

  10^/10

  guloadernanocoredownloaderkeyloggerpersistencespywarestealertrojan

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2