Extracted

• • Target

    REVISED ORDER.exe

  • Size

    216KB

  • MD5

    5f5a1aaf1ee00e8b0b0b6a62713053a2

  • SHA1

    0caccf489130536d51fa8b210b170434d8b4e388

  • SHA256

    7ab96517f6852c124c82edf441496b2f005b11a4d1feb92f9cbfa2a2bffd1acb

  • SHA512

    6f3138f02db278e4390d3b37bc1c84acb3d92052c290ffc2c732052fa273255f0de4e3b93b4c4f9cf48a7e95bb9a1d37adb2aa6ab6cca4467f36069d3b6086ab

  • SSDEEP

    1536:SKP5h81dkoxFBD8OXZ4zpS8JhHnF9YdGKyj2u2sOqCKjMbx3xxAOBT:5P5uDgOeFJJJItyStqybLKOBT

  Score

  10^/10

  guloaderdiscoverydownloader

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent state file

    Checks state file used by QEMU agent, possibly to detect virtualization.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2