guloader | 41ea7154db5991f96b1ebcbec4e94b004db3b19f44d2b2ddf207ba81610409b5

General

Target

41ea7154db5991f96b1ebcbec4e94b004db3b19f44d2b2ddf207ba81610409b5.xz
Size

710KB
Sample

250218-cydcysxms6
MD5

d7f639e35e5aae78854578fa009ff2da
SHA1

abbaae985dbd6b05601ca4b274261032437b569e
SHA256

41ea7154db5991f96b1ebcbec4e94b004db3b19f44d2b2ddf207ba81610409b5
SHA512

e463829b606c2a456d507b0d47b94e8bc744aa27b4314f549e1e93b4400c9352aceca6989cb31021e3ae6df314ad6b18b5b48121bbc706244790799eeac4ab67
SSDEEP

12288:eNXPL2rqozldWNFKzRGvCQ+/4Sbba3Jp7eKlK6CNKTmMgSJTqZJQPmRcN+EqvfJN:eNXPLdlNItUtmhbe37BlKBIvJ5+muRcQ

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

odg-RemoteHost

C2

odg01.is-a-landscaper.com:49950

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-GN5MV3
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  ELITE TRADING LLC_PRICE INQUIRY-05002025-024142914208136738390-00143983188212000.exe/odg-Diskontoer.exe
- Size
  
  930KB
- MD5
  
  c730d2226304c997f5cc1124a9cfe6fc
- SHA1
  
  79e71e9efb193582619f93287202404d73348088
- SHA256
  
  e81747a9ede60d251a5cca15da28963fb84975bcbd4f6ff2bb96558639dfc9e6
- SHA512
  
  b19281c8bbe04847bd4000da0569f9c9aa05be60e8b29c12ab116f8fa352d120675db8c165b00315366e13e6a0b5d055c36620f2f51eea300dac80deadd71e68
- SSDEEP
  
  24576:FerYnK4TwIld1V20+FDbzUMX5gBb4J4MOqsk3UiFZ:FerYnKRIlHV20+FDbzhX5gOJ8TJiz
Score

10^/10

guloader remcos odg-remotehost discovery downloader persistence rat
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  dd87a973e01c5d9f8e0fcc81a0af7c7a
- SHA1
  
  c9206ced48d1e5bc648b1d0f54cccc18bf643a14
- SHA256
  
  7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
- SHA512
  
  4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
- SSDEEP
  
  192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
Score

3^/10

discovery
behavioral3 behavioral4