Extracted

• • Target

    d032bf21aa1029b3d49763fd303dd84ad36c303a07ea1293e039bc8c35c0e1e7

  • Size

    164KB

  • MD5

    0040a650409cbf4a64597ee1f64b874f

  • SHA1

    3a54dce238334d6d59ba7a796a43e86c917478a8

  • SHA256

    d032bf21aa1029b3d49763fd303dd84ad36c303a07ea1293e039bc8c35c0e1e7

  • SHA512

    e54cfb9af724864753a8a6eede4b1ffa5b1e95e8082d5c306f6ad16342af2e48bcb4bf6b137ca43407970cb18ebab16580eeeaf50d425d06fe40e761d93dda49

  • SSDEEP

    3072:etOcNsL93qdY0F51nCyBQifSgwKAs/RF53IyVx1rm7gwc3yGChGZrjFZxFsKdxw6:eUV0rC3i6gys/RF53IyVx1rm7gwc3yG3

  Score

  10^/10

  guloaderdiscoverydownloader

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2