Extracted

• • Target
    6f9433489c234b56f12a5e807ad4bfcb.exe
  • Size 404KB
  • SHA256 dfa04d8d3ce15de46fb7556375eb5ec64fc97d71c2275b6a471c86563ba7be71
  • MD5 6f9433489c234b56f12a5e807ad4bfcb
  • SHA1 ae8750199ab02846f125aed3551e52404e618bfd
  • SHA512 21fb96b7b6f535d3c3718c72910515923adb08bcd010844574b9a3419214bca082b051e264f52b7da45ac4f542d7e15a24c2ae2ad4e9dfbedc38faf870456075
  • SSDEEP 6144:CBe337n8xkABZYQkqIqZ7zz7/3QVgJ9glpKRXhK0tuIAeaPmjJoFGCO:v7LABZYQk3qxIV/GX002WOFlO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookguloaderms14downloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Formbook payload

    rat

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2