guloader | 59146210128ee1a74ca1eb304bb156d7c83b3c85f3bc95a861fdb8ad2c885b3b

General

Target

PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe
Size

855KB
Sample

250212-kjmbbatqek
MD5

0bca5053e588b923a819758a40d15fcf
SHA1

3ced9b60e382958d810022d5aa7101b828dfd8a5
SHA256

59146210128ee1a74ca1eb304bb156d7c83b3c85f3bc95a861fdb8ad2c885b3b
SHA512

51a39f3cdfe1909979162fac0ce6051239004cae07dd229462bb65bf7fe84f579c0cddffa828a8c533ef468b3c183fc19a4dfc4781d674503be228f609f4b8cf
SSDEEP

24576:vpwwZ9hDcP30jmiX0ZoDTRgrLTr8436/V4uVtCNOyO:Rx91cv0rOlrLTzK/VSOyO

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

chima

C2

198.135.50.224:53648

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-512LV7
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  PAYMENT_ADVICE_0020112025-02414291420913672819036-54882093562512209.exe
- Size
  
  855KB
- MD5
  
  0bca5053e588b923a819758a40d15fcf
- SHA1
  
  3ced9b60e382958d810022d5aa7101b828dfd8a5
- SHA256
  
  59146210128ee1a74ca1eb304bb156d7c83b3c85f3bc95a861fdb8ad2c885b3b
- SHA512
  
  51a39f3cdfe1909979162fac0ce6051239004cae07dd229462bb65bf7fe84f579c0cddffa828a8c533ef468b3c183fc19a4dfc4781d674503be228f609f4b8cf
- SSDEEP
  
  24576:vpwwZ9hDcP30jmiX0ZoDTRgrLTr8436/V4uVtCNOyO:Rx91cv0rOlrLTzK/VSOyO
Score

10^/10

guloader remcos chima discovery downloader persistence rat
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Downloads MZ/PE file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  b8992e497d57001ddf100f9c397fcef5
- SHA1
  
  e26ddf101a2ec5027975d2909306457c6f61cfbd
- SHA256
  
  98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b
- SHA512
  
  8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c
- SSDEEP
  
  192:PPtkumJX7zB22kGwfy0mtVgkCPOs81un:E702k5qpds8Qn
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral3 behavioral4