Extracted

• • Target

    82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f.exe

  • Size

    421KB

  • MD5

    92b8b8d35ba16bf772e1c3c55972ccda

  • SHA1

    4cb1fcef30fdcfe0f590ba1f223787939257ba36

  • SHA256

    82d48c9bb4936387228e0de374d235ac364bd4011519b988623707cb7025150f

  • SHA512

    fed3b35b7f131fc80ca8d21f697ea0e91f3b9ed04eb36087b5d652a3396ce46e649dd6f401839ca0235a1c7bcd7e777c7cf27898ae00fe3dfe1712f0064b6be6

  • SSDEEP

    6144:vmOPuFNlaapl0zQwY0CyKlBGfpnAW4VKDkjdl8Jp42KcUMhmtL6Rt93WhX3A1maq:AlhpcCyKOf8l8D42XmxOt93OXQ1eoU

  Score

  10^/10

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2