guloader | e3fe07f87b41a5b796c4bf9d657c482367668ea4de33fa86bf6bc75b9904357f

General

Target

e3fe07f87b41a5b796c4bf9d657c482367668ea4de33fa86bf6bc75b9904357f.exe
Size

1.0MB
Sample

241018-dftgwsshre
MD5

3ac10da2561b50bc38b8c8e328850965
SHA1

4fcd399954d96ff5ed99e1e142049441ff40e5e9
SHA256

e3fe07f87b41a5b796c4bf9d657c482367668ea4de33fa86bf6bc75b9904357f
SHA512

32652516c763628831e9fde805054cd706d1a32f67569f6187ea5198f580c7aecfa3d5fecb1f808e5e060837aba9bbf1cd182285e2161d8945a727cc1f54ca1b
SSDEEP

24576:RYPWVKIQMfAmKIPHi70rXV0TP0TDAS3y7zIeYOCW/yVXiCIVl1:REW0IQYfw0dnguxW+Xi9Vn

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

162.251.122.111:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-JXEKG5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  e3fe07f87b41a5b796c4bf9d657c482367668ea4de33fa86bf6bc75b9904357f.exe
- Size
  
  1.0MB
- MD5
  
  3ac10da2561b50bc38b8c8e328850965
- SHA1
  
  4fcd399954d96ff5ed99e1e142049441ff40e5e9
- SHA256
  
  e3fe07f87b41a5b796c4bf9d657c482367668ea4de33fa86bf6bc75b9904357f
- SHA512
  
  32652516c763628831e9fde805054cd706d1a32f67569f6187ea5198f580c7aecfa3d5fecb1f808e5e060837aba9bbf1cd182285e2161d8945a727cc1f54ca1b
- SSDEEP
  
  24576:RYPWVKIQMfAmKIPHi70rXV0TP0TDAS3y7zIeYOCW/yVXiCIVl1:REW0IQYfw0dnguxW+Xi9Vn
Score

10^/10

guloader remcos remotehost collection discovery downloader rat spyware stealer
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  fc90dfb694d0e17b013d6f818bce41b0
- SHA1
  
  3243969886d640af3bfa442728b9f0dff9d5f5b0
- SHA256
  
  7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528
- SHA512
  
  324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6
- SSDEEP
  
  192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
Score

3^/10

discovery
behavioral3 behavioral4