Extracted

• • Target
    99b387d1de76dcfbb4cb6c33eb919a49.exe
  • Size 388KB
  • SHA256 4aea5f6079cedf9c5205a0939e9c05119d5df7d73dde0f3a19ab2fd09a6443da
  • MD5 99b387d1de76dcfbb4cb6c33eb919a49
  • SHA1 1dc8d59df6c8845b354da2b60e9b1926167dcd7a
  • SHA512 de60e793fe3c1bf9b4e37630f1afc314c109908db873e1a66afad44684b280f25d1fff37ceb97e478f181bda493cc960fb78abbc8a3420e8936b73319e2771de
  • SSDEEP 6144:pPXoDQpcUz+TfBDma1bGy0IvoS8JK2ZLvTh0XTTmVU5t/HQG0TLi:hWDfhMeoSl2ZLLGXT6eP/HbEO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookguloaderms14downloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Formbook payload

    rat

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2