guloader | f42d4117f7266093df5de5b87d5e31c80fed30703422424d1ef07e826381ce3e

Sharing

Copy URL Twitter E-mail

General

Target
Test.rar
Size 4.7MB
Sample240119-qsnhmafee4
SHA256 f42d4117f7266093df5de5b87d5e31c80fed30703422424d1ef07e826381ce3e
MD5 2834eccaae8036f6b446ba152ce03c22
SHA1 d72c41dd94d363d3309271f45b59bd91d414970a
SHA512 ae97e8995ed35fa6883eeb243a1a9045ce2a03c47ca0ab74d7ee820687873e0b8150d7474e587c186f749fa19e60eb1076730f4df22249ae70baa863e6f3962c
SSDEEP 98304:uuv6y9uTOb6d6tAmocPg3wmJi1SXqjsvoSpEgQ15t27+fYB6/Rh:XSjiycPgAmJvXqjsvotgQ/MkYQX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

Gift

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
kijoup.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
almereits-FAJYX7
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

xworm

Version

janxworm9090.duckdns.org:9090

Mutex

UwOmMMNWmpCKQdsF

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  2/c754746b7a2060c78181a8d49216abdc1f63d722d40da9ae9b9ddc7322642cc6.dll
- Size 411KB
- SHA256 c754746b7a2060c78181a8d49216abdc1f63d722d40da9ae9b9ddc7322642cc6
- MD5 64c38d0e2ee4a23dd5a6599177620978
- SHA1 8caa4a70e8a72975e6da99e2aa8879cd757f9ff3
- SHA512 d19ecad216ff8d810de80c9b0df3ecc5516c0e49f322a71848a98e2f2af3247f5af693c148bf083cd5e8f9f02edd49ac6a2bd5aa4a29566fffa4690dbbd8d1bc
- SSDEEP 6144:KvUboTloHCuuuuuuYzonkTEw9aVr8DaohFp4m+0:K0o2iuuuuuu0on7JC2oPp4Y
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  2/cloudmusic.exe
- Size 171KB
- SHA256 d6b5e2a415feaa2f658e69fc29f6c2d529698db293ad4a785d7822efed9fcd0e
- MD5 a80f1cb0a69392a9e2a59137ea335b26
- SHA1 b7ef0be775e5d84c83faf334e267a206f231ea44
- SHA512 bae411332a0cdcdb463ac438441dffa28f3c8aa54560f084bda8f3c82125b07df5e3d0defeb63a427c2ae6a39e4518287095113570367a4d1003baa90285f5ec
- SSDEEP 3072:msX/ZD7xGjfzm+yPgeA2l4PVP8ermGQNB1LSwx3EF:X/TGe+S0iH+wx3+
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  2/shuiwuz (1).exe
- Size 7.4MB
- SHA256 0ec73d9b236e9011b38793927494d116cbf7d43b84756749414eae9233faa1e6
- MD5 93ae50a8e369ca948789caaa5a2df749
- SHA1 93472c443624cf291a0f1b933df62e70e1157b49
- SHA512 e2abae804fd84449dd79726c0ec296b27217b06f1aa95940354e549d266fc3e4f4a3337a6d9939bd4f88c4dc081930ba67ec5fa86c7acade7d13f83e1e9de502
- SSDEEP 196608:6B+FNGydTRaABSUwNNoBqqZzOLxo5TZMH1:6BuNFdTMABa/E+xoB+V
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  3/026856984.exe
- Size 147KB
- SHA256 90c760d46d9fafa83237edf7a03290d583fc7d00ec71478e3f9dbe4a405e0e22
- MD5 119b5c986a349fffde5fea6acf497c9f
- SHA1 9e2421dfafede33344759aed27ffc0c56f9e3790
- SHA512 ea3c8af97f2a1a6b45e775bb5cc685ac81c55ae9c875138a70b58a20b3c2014f461300ad698de0d7b0d8726c33d26dc52fc107124117f153faef288b8a7bdeec
- SSDEEP 384:KmUPIxN2C9Ht/VEnzgZIYaVpI24cdX3Ho/IWZcDBNy:awx0SHt98q24cdHo/I5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  3/033002100723.exe
- Size 147KB
- SHA256 76a30c13effd223451840b78af04284b9f4102f4ebee1117a33947d0ad0cdb53
- MD5 6179d2fbbb77aa71800e2a18545f18b5
- SHA1 3b674b931d19ec85438d14c87cc51008c3292a70
- SHA512 deefcd9f525d7662cca0280bf409ab2c6bbbd6ab126bcab9c56f163a51ad55bbf1314bdb007e9eeb4e43e18f831c61ddc3adc006a73a77f313b4efca3a9e3726
- SSDEEP 384:KmUPIxN2C9Ht/VEnzgZIYaVpf24cdX3Ho/IWZcDBNy:awx0SHt98x24cdHo/I5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  3/2c33f66369e83e9d7a2fbf941a2b86008d66b8c4f267220299b6a7fde9612b5f.exe
- Size 147KB
- SHA256 2c33f66369e83e9d7a2fbf941a2b86008d66b8c4f267220299b6a7fde9612b5f
- MD5 c45917f4c2705940a161bb59577bc07d
- SHA1 54b8b8216edc3b57d6e351c8986b9d77b5db9cc6
- SHA512 9f1a20665155f595b7d396d2b50b3df5ad23cbc73e69380c1408111e1e30c988dc6bf07b0d495f9e352aa45475570e59f72b4f1993c460fe9cb8d9261874d6ac
- SSDEEP 384:KmUPIxN2C9Ht/VEnzgZIYaVp6BgL24cdX3Ho/IWZcDBNy:awx0SHt98T24cdHo/I5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  3/402181be0b460a436fbf6ab47b98b9cb3453fd07edce333a2ab8d14921dfc08b.exe
- Size 147KB
- SHA256 402181be0b460a436fbf6ab47b98b9cb3453fd07edce333a2ab8d14921dfc08b
- MD5 bab7e80227b786223cfe73b68c5a2a17
- SHA1 815381110869131afc0c2832ced64d6ae1cd98a8
- SHA512 304cd8f8dbf91ca9dbc27afbb6dd64c9f8b2373656ef0328e4a4207af62bb03f7b1686531f9d0a26fcf718d313a4d92ae9919597b3e7338fb7cf5f269ddaf0f5
- SSDEEP 384:KmUPIxN2C9Ht/VEnzgZIYaVpx24cdX3Ho/IWZcDBNy:awx0SHt98/24cdHo/I5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  3/b3dadaf8d877e81697cf4a6540a3e08cd3aa616dc8b6d411d20422bd9465583c.exe
- Size 23KB
- SHA256 b3dadaf8d877e81697cf4a6540a3e08cd3aa616dc8b6d411d20422bd9465583c
- MD5 01d3b116ee0a2b1a60fa5bd4fccada70
- SHA1 e33cd23968ab1ed4dddc2acda1100ace4a967f84
- SHA512 207b1d85688821ba5ff78f6758861768fc451b8cd3fa6d7c1c44b275601a7526be849bc47f8170ebe88e1cd5f2a3cd5d5eae2afe40dfc235c8e87fd53d13dc3e
- SSDEEP 384:WmUPIxN2C9Ht/VEnzgZIYaVpku7YjEbOdo4ytlTfFnu:Owx0SHt98iu7YmOQJU
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  3/f6c885f0db919bbafa356aa67092f6ed7e78b6ef5e79cbb99ce5a57b4e446d9e.exe
- Size 448KB
- SHA256 f6c885f0db919bbafa356aa67092f6ed7e78b6ef5e79cbb99ce5a57b4e446d9e
- MD5 368cad09dcc695e4e6a6767c4545001a
- SHA1 35dfbd14b61a7303e57e0c9a9eb44ba3f6d5ef76
- SHA512 1156e4fd4ba03641eccd3d5ce068659c97c63d1cfd4b1c49010da882713e3723828dbc584010cb7e7951ca190212411dea3fdd8a308337800bdc18922716ba6d
- SSDEEP 3072:MdiaLNdM/5njwahElSM2bFcAa5QD6URjX6BCUBmF:7GdijZhE8M2XaeZ0kUB
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  8/4.exe
- Size 613KB
- SHA256 423604ac30c7f4cbb83564770f1ad5d708c2de3db93880841247f6cada0e2d10
- MD5 ebd5efc41977cc8ccc9d78349cd7009f
- SHA1 1a81a793d63acda2a097a04d55bda58831ee40c8
- SHA512 ef22def45a509344b600f8bad331fae090a873eb639782d0a4d4146f67e1591425870891bb6eee97d53d2c0a36ce19f14a2e398762e415efdfb570c0427eb089
- SSDEEP 12288:8bEVyhb8nWcR6N+SviQZ7gHHgtooS2/xpExnRNCxXLqIu:8bEtW+6QoiuMHgtoonwn6sD
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader remcos gift collection downloader persistence rat spyware stealer
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral19 behavioral20
- Target
  8/7.vbs
- Size 20.0MB
- SHA256 894e0387f103426567c590e681f067cd3b9eb543bffa4b00f17922f331c033c6
- MD5 f335466906efec9cddd65c81ed2567cc
- SHA1 b773b2a733572d4705634b57b62780b5af7cb512
- SHA512 7de2133fce069b0c188ea6108e1c69684af0fc6d147734cc89c1ac2e3154f8b1b81df202b6b9e8ca78dd40ffc96cd30a1f3488597aac2eb0718cf5176c5f38e4
- SSDEEP 192:lCILS5gomCMJHeLIQAKG6SSnnBlWgj7bWxDGULRL0r8mVk17:wILXCMJw7AKKSnBYgjWhGULRYrZVk
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral21 behavioral22

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Guloader,Cloudeye

Remcos

NirSoft MailPassView

NirSoft WebBrowserPassView

Nirsoft

Loads dropped DLL

Reads user/profile data of web browsers

Accesses Microsoft Outlook accounts

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Detect Xworm Payload

Xworm

Checks computer location settings

Adds Run key to start application

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22