Extracted

• • Target

    ArcelorMittal Trading - ARMT#4562198.exe

  • Size

    120KB

  • MD5

    04a2e456c4d65d43e9217eac7d90f9cb

  • SHA1

    42320cbab30a997244f3aa370f28ee8fb425efb5

  • SHA256

    154c8ad4fe041cb711c139005c210a63f15c3c030cab34e358256c4375a06aba

  • SHA512

    f25cb6e5ed0cf45e084576dec7f8ad53cdca44796c59552ee025fe17871754c9d1419a0a436e0c57ef9fccb675dd55de3b9d9b0ecb9a99ba0ae48f1611c58266

  • SSDEEP

    768:u3YiUCYV5XSEN95IQtkvQhHv1TfXRjMWzeIBglpbmAFDEF2HnA8iyB:u3YiJYVlLIW5RjoTlpyAa8ArU

  Score

  10^/10

  guloaderdiscoverydownloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2