Extracted

• • Target

    caafec374594c5b93a986bc31df97f17.exe

  • Size

    402KB

  • MD5

    caafec374594c5b93a986bc31df97f17

  • SHA1

    8c2e069e2f715e6172492e1009e64009dc8b2558

  • SHA256

    99db3b5192d77a3db297df19db4e486c3af98416b0c023720fa2f3e88d6086cf

  • SHA512

    7384cacada091dc29204c870e33e852d08e39185c09bf96dc1d228b843b368a4833a5912f50d21d5eeb3509dd260e9078f8b3fa868455c1e687c2ea9c2feb122

  • SSDEEP

    6144:NPXoDQpcUz+TfBDma1bXGBZnvjFh64S07Qfy6JdRpNWMv7PW62swd:NWDfhWBJjF6aezNWgPJ8

  Score

  10^/10

  formbookguloaderms14downloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Formbook payload

    rat

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2