guloader | 6b2479bc7ad5c52879ffb5cc52de9638a86b878e613fff5d26374119b400b663

General

Target

scan_241205-801_draft_PO.z
Size

868KB
Sample

241205-s3pjsawrfn
MD5

0bec1651bcd4b2e362a17f3384a339df
SHA1

16ba42d70141281fc612ef09dcced396b3e7ad85
SHA256

6b2479bc7ad5c52879ffb5cc52de9638a86b878e613fff5d26374119b400b663
SHA512

6addf38c759bcd3e56a6da0434d3fc2061d69e44d3669f10c32451c2f75edacc2c5862dedd790f7d27058cf3235ac90ff2a6cca96e2030e11be5b3540818d188
SSDEEP

12288:Yhuj7ABQvOqfDqVXjSwQyaKVyVC4fHOtPn32E8RyD6IHK33WreFbkl3v2iuo5sl:YhUAyAVXhlVyVTmt26DZHK3TU+8U

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

162.251.122.87:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-UOMZ21
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  scan_241205-801_draft_PO.exe
- Size
  
  1.2MB
- MD5
  
  16df1bbb45f31ef099862d1df04b9741
- SHA1
  
  e9c1056bc30a3817d84656a944b39190cbb1b7c9
- SHA256
  
  b5486818c1913895b913ace02e94fee62a6468b3df96abd6c75c863499873dd2
- SHA512
  
  083ed41b277bfdaa0876c756868acb0286d22eb498aa4f18638a258a86559ddc6bce35d777b259f71b7d392291d5ee0ad346671931c562c89bafc4c555d877cb
- SSDEEP
  
  24576:tmwFwYo/knJ5vkeSTejf+WNvXgd93W0wbenPc15QClzZ:gkVosnJSeSTw+WNfgdlZ0iPc/Q+zZ
Score

10^/10

discovery guloader remcos remotehost collection downloader rat spyware stealer
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  75ed96254fbf894e42058062b4b4f0d1
- SHA1
  
  996503f1383b49021eb3427bc28d13b5bbd11977
- SHA256
  
  a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
- SHA512
  
  58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
- SSDEEP
  
  192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
Score

3^/10

discovery
behavioral3 behavioral4