Overview

overview

10

Static

static

3

IMG-WAA-00...ar.exe

windows7-x64

10

IMG-WAA-00...ar.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    IMG-WAA-00234857845959375893759375935Fluorspar.exe
  • Size 827KB
  • Sample240212-vdyr9sca43
  • SHA256 261db68ba8a04022ee11a91014745c952e443fa07818fe8b9319345fc4556a39
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
guloaderremcosdownloaderpersistencerat

Malware Config

Targets

    • Target
      IMG-WAA-00234857845959375893759375935Fluorspar.exe
    • Size 827KB
    • SHA256 261db68ba8a04022ee11a91014745c952e443fa07818fe8b9319345fc4556a39
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    guloaderremcosdownloaderpersistencerat

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks