guloader | e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf

General

Target

e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
Size

885KB
Sample

241105-e11x5svgmj
MD5

5009d8c72623d30ce09149187c66d37c
SHA1

5c6035f099f16ff4753198e5f631ba410e98227f
SHA256

e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf
SHA512

5908f38589b4097fd96f35129bbfa344a7940193ef0df6dab4e514106e7054c8ea9b3e97f9ebb7ff36fdbbd7c724cd1500e37f6c1ea6013f51842d39a642b5c1
SSDEEP

12288:i3nIF6bq58AFe0TenvBdHdpUXjwxipfpQGYAGau5yxX9O9R:i3IFsmez5pdpUXjUiNuGYpawA9uR

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

162.251.122.106:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-BHLA3T
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf.exe
- Size
  
  885KB
- MD5
  
  5009d8c72623d30ce09149187c66d37c
- SHA1
  
  5c6035f099f16ff4753198e5f631ba410e98227f
- SHA256
  
  e38bdd8374c7e1640e8fe34c531228dd9389affb9659cb7c49c00129baa73bdf
- SHA512
  
  5908f38589b4097fd96f35129bbfa344a7940193ef0df6dab4e514106e7054c8ea9b3e97f9ebb7ff36fdbbd7c724cd1500e37f6c1ea6013f51842d39a642b5c1
- SSDEEP
  
  12288:i3nIF6bq58AFe0TenvBdHdpUXjwxipfpQGYAGau5yxX9O9R:i3IFsmez5pdpUXjUiNuGYpawA9uR
Score

10^/10

discovery guloader remcos remotehost collection downloader rat spyware stealer
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  6e55a6e7c3fdbd244042eb15cb1ec739
- SHA1
  
  070ea80e2192abc42f358d47b276990b5fa285a9
- SHA256
  
  acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
- SHA512
  
  2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
- SSDEEP
  
  192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
Score

3^/10

discovery
behavioral3 behavioral4