guloader | 7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d

General

Target

7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe
Size

1009KB
Sample

241112-c2g6basjbt
MD5

5b9520cdce201fecd22a108edc4b9927
SHA1

6afb7c1ee328ec47ff4aabe5a19cd2d26ab54c1f
SHA256

7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d
SHA512

73e30d7e7f6519216f96638b025f4ce844c11ee90176bb4c49a0923b63423b246f22638db2c5bf61d7c874203edabdd7d4fdd0c651bfdf7b17311278fc67d750
SSDEEP

12288:l0g77CaJ/85VedbvaOvTks8Eac9Q7RS3iDpDUJMDVb8hAvaiKz4R39HzIluzTB:PCm85VwaOLkTjcGciDUJ2bsV21IAJ

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

185.149.234.209:2700

185.149.234.209:27000

185.149.234.209:28000

185.149.234.209:29000

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-FP3B7O
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d.exe
- Size
  
  1009KB
- MD5
  
  5b9520cdce201fecd22a108edc4b9927
- SHA1
  
  6afb7c1ee328ec47ff4aabe5a19cd2d26ab54c1f
- SHA256
  
  7e1c0ca51cd0f6806f1fe6ddbb45fa4e00b288c686003f3e50b5ee71d2c6818d
- SHA512
  
  73e30d7e7f6519216f96638b025f4ce844c11ee90176bb4c49a0923b63423b246f22638db2c5bf61d7c874203edabdd7d4fdd0c651bfdf7b17311278fc67d750
- SSDEEP
  
  12288:l0g77CaJ/85VedbvaOvTks8Eac9Q7RS3iDpDUJMDVb8hAvaiKz4R39HzIluzTB:PCm85VwaOLkTjcGciDUJ2bsV21IAJ
Score

10^/10

discovery guloader remcos remotehost collection downloader rat spyware stealer
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  34442e1e0c2870341df55e1b7b3cccdc
- SHA1
  
  99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
- SHA256
  
  269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
- SHA512
  
  4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
- SSDEEP
  
  192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
Score

3^/10

discovery
behavioral3 behavioral4