guloader | 20421f80185ce3c93795eac31090d79cad1bdbe360c1c8d7da261fe66edde7c0

General

Target

malz (2).zip
Size

503KB
Sample

250214-hw9ahawnfn
MD5

a223f777ebf9b1c1b91b55ce0de7f8a6
SHA1

1f75f33686cc320ba453fc93611baae83c61d1f1
SHA256

20421f80185ce3c93795eac31090d79cad1bdbe360c1c8d7da261fe66edde7c0
SHA512

d34021fee70b2c512e5a55bab98dcf1c643c77a7bbfd4606e9b2047b718df1a875e4b8d3f298cb286d810ee1430470edb332ba1a67285f449eefdc163c6c422a
SSDEEP

12288:ChWPi9T2NHG9pBnUmWdxyjgyjcvbCRU5NW+sj2cX1QVwpgPzKW5B0Sw6p:CwP+8H4DnUR9Eq5NWbicX1QVegrKSNp

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

Chima

C2

naps.is-into-games.com:53648

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-67ZM90
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  8b51c970ee535afb8f8279e82c1cd2cc28b76fdd05ee96a8fed97be7421f8eee
- Size
  
  517KB
- MD5
  
  7b60abf4b403f6b10d43ae3c0559eb72
- SHA1
  
  7211b8be413c5cb8bce4cc439a20d4df8cf8329d
- SHA256
  
  8b51c970ee535afb8f8279e82c1cd2cc28b76fdd05ee96a8fed97be7421f8eee
- SHA512
  
  2c5d00faf08c03d01bf49f658809903fe4ac78f19fb35a17aab3de78f5bd8510df50f54030a1fad5191d040653ff33415f466b23daf426d20bb8f95624d49c5b
- SSDEEP
  
  12288:IjOK3DWAvnkbZzhb50GZTNpSSZyNDTN6BwoshI17UhshD0cv:6/zZkbZH9pB0V4RvxUiFF
Score

10^/10

guloader remcos chima discovery downloader persistence rat
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Downloads MZ/PE file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  dd87a973e01c5d9f8e0fcc81a0af7c7a
- SHA1
  
  c9206ced48d1e5bc648b1d0f54cccc18bf643a14
- SHA256
  
  7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
- SHA512
  
  4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
- SSDEEP
  
  192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
Score

8^/10

discovery
- Downloads MZ/PE file
behavioral2