Extracted

• • Target

    5014b473901c1517c80fa4229172b855af67b2f20f2e7e61bee8d21a9bb94478

  • Size

    112KB

  • MD5

    9349b201422e4379371e654df66f36d9

  • SHA1

    09f1fef440b74e77b0e042382f2ba0eb50a39c0c

  • SHA256

    5014b473901c1517c80fa4229172b855af67b2f20f2e7e61bee8d21a9bb94478

  • SHA512

    d0b70d9899f9d8cc5cd39bb56acb8b7b528b49c9112cee747dd03dda285b6883fdd9c1cace533871d38de242db0fba2e8990737531a36b3bc89221f2beffe342

  • SSDEEP

    1536:ivTyyLKKgDDqwLffBVucXY38Vaj8UNN3jUEQ:/yLFczBVFIMyzNNU

  Score

  10^/10

  guloaderdiscoverydownloaderguloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Guloader payload

    guloader

  • Checks QEMU agent state file

    Checks state file used by QEMU agent, possibly to detect virtualization.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2