Extracted

• • Target

    f6f94bb93ac1d68cb13e2a9d3392f13d_JaffaCakes118

  • Size

    64KB

  • MD5

    f6f94bb93ac1d68cb13e2a9d3392f13d

  • SHA1

    4a2dbe985aa6e34e51aa6e431994ee07dbe13bdd

  • SHA256

    afb42e7a147dd23b1d2066bea53aea0e6f33bcd4751afc835df327b2436542e0

  • SHA512

    80538894abd107a3838a863922d43a431418d52a94a45e2738ee1b84f39cadd0a1c291a017b5be2585e9c33f38ce527e0afe3db60680416a57670de4b856eef6

  • SSDEEP

    768:H0QEsl7YC/UdJkgLedN4abfHe2bc8oztlkRomyeM/WETv:H0QrpY1kiDcvr6w1Mlv

  Score

  10^/10

  guloaderdiscoverydownloaderguloaderpersistence

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Guloader payload

    guloader

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2