Extracted

Extracted

• • Target
    13e0cd9d_by_Libranalysis
  • Size 109KB
  • SHA256 aa474883fd952e16e13715aa7a698fa8eb0d596fea71d03dfbaa235a1b08aa15
  • MD5 13e0cd9df74775213bc78eba0c269add
  • SHA1 9a47bf42898712ac86683f9af9df0c6943059f6d
  • SHA512 45421ff33a5cdc0cb86aea95ba4496b29b2cfb13e6c80548d9cc45bc2e9c1a2e161a99d0deda0defbb95a134305b04c98530ff19fae1e5aea5691e7ee55d17c7
  • MD5 SHA1 SHA512

  Score

  10^/10

  guloaderremcosdownloaderpersistencerat

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Executes dropped EXE

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2