Extracted

• • Target
    caafec374594c5b93a986bc31df97f17.exe
  • Size 402KB
  • SHA256 99db3b5192d77a3db297df19db4e486c3af98416b0c023720fa2f3e88d6086cf
  • MD5 caafec374594c5b93a986bc31df97f17
  • SHA1 8c2e069e2f715e6172492e1009e64009dc8b2558
  • SHA512 7384cacada091dc29204c870e33e852d08e39185c09bf96dc1d228b843b368a4833a5912f50d21d5eeb3509dd260e9078f8b3fa868455c1e687c2ea9c2feb122
  • SSDEEP 6144:NPXoDQpcUz+TfBDma1bXGBZnvjFh64S07Qfy6JdRpNWMv7PW62swd:NWDfhWBJjF6aezNWgPJ8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookguloaderms14downloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Formbook payload

    rat

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2