guloader | 154e972d6a981ad2eeee22b71c5af4757aa1b560f85a386634800663408321d2

General

Target

d32210fc-fd93-11ee-afa6-91d35d70b1c4.zip
Size

22KB
Sample

240418-3ebccsba6w
MD5

0bc97deb83f92411213246e4460a2267
SHA1

89d259ca52d99300eede3e459efca2b48fa3af56
SHA256

154e972d6a981ad2eeee22b71c5af4757aa1b560f85a386634800663408321d2
SHA512

c7c6d71ab31dbbc0a3c7ab82f93d3ab6a2ce38399fca456067ecf99b5858dd90626361868d4a9ac4c2f6a643544dbf9c2a96924def1e94d4cf72e56412d3dd9a
SSDEEP

384:75Z4ZROaIQey9ofX+TTxBEfcx23Li+4G2IKOGWZJmAwal7bRou3QSoy2mY6xTWQL:YaaIQey9oPKTTfKLi+kIeWZQAwMbRoEp

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

Great

C2

lakour382goufs01.duckdns.org:1780

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
damarsyts.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
jasieotsbok-6J6ZDL
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  d32210fc-fd93-11ee-afa6-91d35d70b1c4.zip
- Size
  
  22KB
- MD5
  
  0bc97deb83f92411213246e4460a2267
- SHA1
  
  89d259ca52d99300eede3e459efca2b48fa3af56
- SHA256
  
  154e972d6a981ad2eeee22b71c5af4757aa1b560f85a386634800663408321d2
- SHA512
  
  c7c6d71ab31dbbc0a3c7ab82f93d3ab6a2ce38399fca456067ecf99b5858dd90626361868d4a9ac4c2f6a643544dbf9c2a96924def1e94d4cf72e56412d3dd9a
- SSDEEP
  
  384:75Z4ZROaIQey9ofX+TTxBEfcx23Li+4G2IKOGWZJmAwal7bRou3QSoy2mY6xTWQL:YaaIQey9oPKTTfKLi+kIeWZQAwMbRoEp
Score

10^/10

guloader downloader persistence
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Blocklisted process makes network request
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  AWB-Shippingdocs1804.vbs
- Size
  
  42KB
- MD5
  
  a269ee68a794bc1937ee2f122ca339b7
- SHA1
  
  7db2bdc98b318bdef18d63862bd09aaa2944353f
- SHA256
  
  2d04a69024d34db3522423b703bb949e5f3b4a1d93f6ce4829578cc1111f368d
- SHA512
  
  9b1cc1d884dd26543dc816efa176f67260d1a2b9b4b81b3b160ccd247b3803443511176174f65f079f30bf8ea73c2ae03faaade760ecaece3ed1d465ba3bbba1
- SSDEEP
  
  768:3a5MtjHffstfbJ9nernOKR/zzk9qgpXKIRdWI5Y19Hny5:3LtLsRbLertkwYnkDnY
Score

10^/10

guloader downloader persistence remcos great rat
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral3 behavioral4