General
- Target სატრანსპორტო ინვოისი- შპს ელ +DE-GE 400 EUR.exe
- Size 801KB
- Sample240530-gzbb7saa99
- SHA256 6e1d980c6302e6c39dfb64c69f8dfc056f4eea385ff865753b41d250d815f4d3
Score
10/10
Malware Config
Targets
-
- Target სატრანსპორტო ინვოისი- შპს ელ +DE-GE 400 EUR.exe
- Size 801KB
- SHA256 6e1d980c6302e6c39dfb64c69f8dfc056f4eea385ff865753b41d250d815f4d3
Score10/10Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
Checks QEMU agent file
Checks presence of QEMU agent, possibly to detect virtualization.
Loads dropped DLL
Adds Run key to start application
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
-
- Target $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 01773690efda3c1fa609287f4bf2277f3d366fe4a1ddc099d2949fab54f0fbd4
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27
Score3/10