Extracted

• • Target

    ff8d576d2a44ebd419da4cd03cd49ba6_JaffaCakes118

  • Size

    48KB

  • MD5

    ff8d576d2a44ebd419da4cd03cd49ba6

  • SHA1

    31de103753c826ed42883ab98daeeff443f12926

  • SHA256

    3ec257ac5b1594efa6862e7dfa6d4a4ed56f81ffb9e5320ce9dc95baaf9f00e1

  • SHA512

    ee719ac80d1b8a1b0bee99ad40aef23ec9a3bcb37f024eca902915209620624574256622782d1b8324d08e32bb4c30c8c04c0f17c52a0686819f5721e6b7de7a

  • SSDEEP

    384:lMd/UDAlKJ+dfZhnISoz2w3z/heMLxgbbMBrTjeVTJ/8jd/wnNnUw0mgWbrwrC95:lk/kAEIlNE2o1LxnBXjeVTJUjJwolVF

  Score

  10^/10

  guloaderdiscoverydownloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2