Extracted

• • Target

    0b793ae840102dff93fa1ec0a38bd603.exe

  • Size

    430KB

  • MD5

    0b793ae840102dff93fa1ec0a38bd603

  • SHA1

    ac9a73ff2b30557949547e4b1d30fb2a2dd3f06c

  • SHA256

    6ae760d9b669fbcc87fd61647e1904de552f09b6af8d36d48eff89df60b06cd8

  • SHA512

    374a7258257a3735bed3e9aa7c941058388d4411d486077e7e77b3b3be6e2f7d9de1ed4496330c6d472482a84ca156780390faca795e5a926dd8e2b6874d1bb7

  • SSDEEP

    6144:AbUTp1kKX7AB/N0A6SgZUNuhYHOrq9V56lSN0WFOnxMfEa+pvLf+xM+Y:AIFEzDgZUYyurc/2KEa4vLfH

  Score

  10^/10

  formbookguloaderu34fdiscoverydownloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Formbook payload

    rat

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2