Extracted

• • Target

    CEMENTOS-DOC.exe

  • Size

    60KB

  • MD5

    b7974ace4e5436770ce9b63a315fab68

  • SHA1

    43aed757f4864e1fab98d88faf690d84435d036e

  • SHA256

    994655b2cfd0979f7b96ae1f4423510633a82adf92fa6486dfd2f3243e96618d

  • SHA512

    287938f69f46de39ceeb2bc078dbc6b6e0850f0ad0df676717bd0dba31ae1be4492dbf584c3c816ef7368a1eb01b5ddcbabee7341efc8cfb66fd1503008927cd

  • SSDEEP

    768:CZZ3hCu+e5MxzVZpXEewlIAc9BRYxLznw72c:0rCupIZZFrWIbW/c

  Score

  10^/10

  guloaderdiscoverydownloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2