Overview

overview

10

Static

static

5f09b37b56...46.exe

windows7_x64

10

5f09b37b56...46.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5f09b37b56cb003804dca1a778799746.exe
  • Size 192KB
  • Sample210927-kfas4sgbe5
  • SHA256 1f2f9b357003d7816259c172bff00bc8be6305247a94594de4eb9a7e7ecbb385
  • MD5 SHA1 SHA512
Score
10/10
guloaderremcosdownloaderrat

Malware Config

Targets

    • Target
      5f09b37b56cb003804dca1a778799746.exe
    • Size 192KB
    • SHA256 1f2f9b357003d7816259c172bff00bc8be6305247a94594de4eb9a7e7ecbb385
    • MD5 SHA1 SHA512
    Score
    10/10
    guloaderremcosdownloaderrat

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks