Extracted

• • Target

    Original copies of shipment docs.exe

  • Size

    92KB

  • MD5

    8b96af7d76b487cea6aa04f565b8cb9f

  • SHA1

    3e904fec3e82c9f01ccc64fbdcde35d306c6147f

  • SHA256

    49559dd2c1d9b0841f3384f3080013f8d644760d45ab7cd4fb4928bb2b91f354

  • SHA512

    786140d030095ce5c0865c21e049c8572e3ee5ec78eadebb15611a4b0f59bac995a306f14e85cd30506cd7661819d3d6a3fe43e4ac714fceb9e0c0991f171790

  • SSDEEP

    768:DUN8RIPdfSAxqFpdyNmqsNjl+mF2AdJVmyzXUsRVVWmZjrFLaH/hQ:ANJEjd+bAlJFvNzksRCQjhGK

  Score

  10^/10

  guloaderdiscoverydownloader

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    pic05678063.exe

  • Size

    92KB

  • MD5

    22b022a5547dbc1c9bcfb8e4d7eb440f

  • SHA1

    952b628cb42495baf73c468d509f249d55aa7966

  • SHA256

    c2544476ab17fd3fb816a97f08f16548a73c106cca80e1f5e185086d25a9f414

  • SHA512

    c1a8f88047f91c4ad9b0e916d17f2c32c3fa080208d1eb77cab0ce57bb8594337d324bf99275bca1c5eb89d5dcf5898ccefa9de83efbe9a3beb2369ac6355c76

  • SSDEEP

    1536:RHR4uv4MRD+wmxH+2POAGcS5g0nhS61D4B:9ym+dRnC5g0ns61kB

  Score

  10^/10

  guloaderdiscoverydownloader

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral3behavioral4