Extracted

• • Target
    98e96c2ccc5c125d947804851df65f324db5d8bedcd60d19f6bea9ed44252e86.exe
  • Size 683KB
  • SHA256 98e96c2ccc5c125d947804851df65f324db5d8bedcd60d19f6bea9ed44252e86
  • MD5 0c09691b8316208374f1bea0ed9cba4c
  • SHA1 d1d3c4b5bfa402e019ae022b7302be255c16ef7b
  • SHA512 029d915acae1dff35eade01dc69f5835ef341776a2df9645de233dd7e858f66e309b8d7e31c20c30c55a2f5fdb29fe9928040a600543550d414fac70bc74324c
  • SSDEEP 12288:QqECucXU4xRUFWC/AMby6OnKjNR5QKRL0NWj9MoEzf:ACucEaUFWC/12xyTQKSoBMDb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookguloaderks01discoverydownloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Formbook payload

    rat

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2