Extracted

• • Target

    Geo Ltd_doc_Invoice_img_021113210211.exe

  • Size

    402KB

  • MD5

    dc29a3a35a1663ab09f9eaa8c206358d

  • SHA1

    46bd5ff1f3bcee5d6eaa9a83934e285e81c67e8a

  • SHA256

    6aed342a5d0971e9b0b9f962f810d5f439b677905292e744abae9d78a9faacfa

  • SHA512

    836121365cc99519435970993744a9723f19c10476b1caac466b82d393544c57c11ea7f14b0508c304283d2d6266e4025f126abc6e8001e24a30c4ecedf6e413

  • SSDEEP

    6144:EspNjlsz0aRDCs8c8ewoeslml+dHRcHck62PHlvwcSlyuaYit4ylMvKGc:EciTR2seeflHETplvbUyuuWCp

  Score

  10^/10

  guloaderdiscoverydownloaderpersistencenanocorekeyloggerspywarestealertrojan

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2