guloader | 544d772118922c50b382935f5403c6b9e6fcffdad5a82ea1ad1aec139c138581

General

Target

24102024_0543_22102024_5702771896_AWB_20240902_225_20240902.rar
Size

788KB
Sample

241024-gelmfawcmd
MD5

54614a7c625ad736dd4e7edc9d5c4b50
SHA1

b5edc7b8939e0a060083bca30daed83f7c1b6304
SHA256

544d772118922c50b382935f5403c6b9e6fcffdad5a82ea1ad1aec139c138581
SHA512

1aec6afe0720528d0e483e76085e2376906023f67e6ee69bb6969ea6e2ff1364d9472fc07a5d552f9a5f12113fd9caaed9428ff469e81cb7f9fef33c79c52503
SSDEEP

12288:YV1fW0SUlPxWe7Xme4INRsfdBzf1lidN/UgicRwtFhyvEmTDsgADEGEdfqqQpJmp:4tSOxN7XmeRqVBjQmbgvEIMEpqqQpJzQ

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

23.227.202.197:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-QPTXAI
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  5702771896_AWB_20240902_225_20240902.exe
- Size
  
  888KB
- MD5
  
  fca7c052afe3a4de2e3d0ce5d500932c
- SHA1
  
  1873d11a40c7a727762ba70780a43a810f168333
- SHA256
  
  f85e3c3cace64f9432cc9588a77cb687cdca8378ec16334923849913632973ce
- SHA512
  
  b6cc45932fe3b6f0042e26609ad3a114872f044a667fbcdcd619e01380e03c77f203d88cbce79a09997ad645eb6f1a7d86217c1ec0f0667d8cc995cc28bb988c
- SSDEEP
  
  12288:k9QQTGWRJxjcm4Z2dDnD7V1xk3ZCB8w6unDxGlxqHkZ084Y5bzY9n8+q8tiB/h5:FQTGWPxImi21Tx1J6uDxaxqHg7098+6n
Score

10^/10

guloader remcos remotehost collection discovery downloader rat spyware stealer
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  9625d5b1754bc4ff29281d415d27a0fd
- SHA1
  
  80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
- SHA256
  
  c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
- SHA512
  
  dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
- SSDEEP
  
  192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
Score

3^/10

discovery
behavioral3 behavioral4