Extracted

• • Target

    bb82589608f2312e9bf9d0c63c8a3d68.exe

  • Size

    371KB

  • MD5

    bb82589608f2312e9bf9d0c63c8a3d68

  • SHA1

    c66d15184ef9a38a7423f1a6fbc60c94132051f9

  • SHA256

    3682f76c6feec004f58d0b9c732b45215375d45f250bdac03fb3694097710c3f

  • SHA512

    c839f9653e021cd06deaa1b529506596598473f8e62347a5a01e88a09fdf6316a17e5cad8502646fc40db955505c44082ba5ed1e62bd2ce8e8bf8daa1dcecb3a

  • SSDEEP

    6144:A6dANzV+OT7ck3Ke1/Lhw5ewNi4F/oJrcy+ShsV6+gn:iP+OTQkFLhaez4FSVsVI

  Score

  10^/10

  formbookguloaderxchudownloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Formbook payload

    rat

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2