Extracted

• • Target

    0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301

  • Size

    406KB

  • MD5

    1482780bd41df6d1dfe68b2629c26d08

  • SHA1

    17145bdc0f9beeea6f8cf5791210d0fd486818d1

  • SHA256

    0e612f991709b9569a9baf7993d185955f6347c574effe5c72e51a9f96a7b301

  • SHA512

    e0fb5c4ae0ae98b231556950fd358feaebdd414f13e5dcf4eb6f3f77dd9ca5e5af930d04a362ceda9628b61029fa56d1659857dea7d3a1cab2ec8a94c0b974dd

  • SSDEEP

    6144:TPXoDQpcUz+TfBDma1bJzSvPRehOGYJmcKeNq1umGANGc8b0:/WDfhNWRgJ8wkFA6b0

  Score

  10^/10

  formbookguloaderms14downloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Formbook payload

    rat

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1