Extracted

• • Target

    scheduler.dll.exe

  • Size

    354KB

  • MD5

    ee003d5904c76e48228192c1ff786e47

  • SHA1

    91baeb13d806e934d9bfc91be5ea5b6eb0d75f3c

  • SHA256

    c9e9fc3a10a439f7e685f46ac95a28c291c8586f0302603f2337547331ae7c29

  • SHA512

    9a79891d82666ba1a7e3d1537ab6d0bf9c5514ec502cbcaaedabbfc6bd2ef545d94b6a67417e1b7311d2448c28a03851dc51c521ac70c273fb47c60656a79f0e

  • SSDEEP

    6144:h4SUjhtXAqTvkWqOs5PC+c5H9ByjuGHK2Tb+w/fw7FtbSJPB7A9K7:6XAqQWqp5C+c5HHyjO2nHHQFtbSZBMq

  Score

  10^/10

  azorultguloaderdownloaderinfostealertrojan

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2