Extracted

• • Target
    Akbank Hesap Özetiniz_PDF.exe
  • Size 352KB
  • SHA256 236c73a241d229cc820b4fa2aa914403151deb84b90939ac4760460fc107dda4
  • MD5 1ca6ad16a4d2deede0baf1dd6329c585
  • SHA1 21a6f5c5545ad757a41da4fc9e4a811325ae47be
  • SHA512 55b41ddbbe74d3b15b4d8cd2a7f072a89e0f7b5f336329184519d22ab0d627621db8f6ba87bbef22c82d1fd7374584ec7adcfd7e5014fb4457ba66c1b8de207e
  • SSDEEP 6144:EQ606ximo8xiNQm7hqnf9oPESPVnR25FdsNF/N1+BCfWUviwYVr2EMKedJLn:/mo8xiNN0Fop9R0dEpN1+4fBYzevT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  guloaderdownloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2