Extracted

• • Target

    New PO as per attached-2020-6642.exe

  • Size

    44KB

  • MD5

    b17644b26f54aee17d39cb7bfceee846

  • SHA1

    a6b0b1155257bbaf9d710fd8d9b92b94601d82d9

  • SHA256

    6f840786f7756f4b7bd84cfc327477af8a3aa99ba9768581f52a7ba3df9af806

  • SHA512

    bad64051fe0604f25630515ffa703304c153752664b846f1f90e8dc0d3bd3c426ccef8b169f013ba3d49dbaf4715be39ae3a0e8ff08ea6177427b22f459eeb93

  • SSDEEP

    768:mVPH8IEd7Qs5a3V4IYRaacERTW3Mst3L:mVPcIm8Ua3GI9Xtb

  Score

  10^/10

  guloaderdownloaderpersistence

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2