Extracted

Extracted

• • Target

    ATTACHED ORIGINAL REF __NOTE.exe

  • Size

    252KB

  • MD5

    995a9f0d72ee6407f3979543930d80ae

  • SHA1

    8e38d89ab142ccbfb95952f873f49df56ab65055

  • SHA256

    77a74587d301dfd79d5c60a874ac580e83c389e8566261f60b09d87cdffa2e38

  • SHA512

    f72e8016c05880bc5a338266e5f4859b88c3c66b262264ce48fb30ca4efbf53eb6101579f46c4f83794ebb332a78e45bda8088b9707454b959a640b0b3278f1e

  • SSDEEP

    3072:A1p9M3scGOWyLvr1f+lwYuJIVPUVJXgcAm6S6l7g98HimFx1zeBgxX:3nG1eJffYuJ4cVdx36Fl7U8mBe

  Score

  10^/10

  guloaderxloaderi8bediscoverydownloaderloaderrat

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader family

    xloader

  • Xloader payload

    rat

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Deletes itself

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2