guloader | 152cacd98d23c36d568c7aeac8ab088e97be55fca99f8acc572fb4cb0baf6ad8

General

Target

152cacd98d23c36d568c7aeac8ab088e97be55fca99f8acc572fb4cb0baf6ad8.exe
Size

685KB
Sample

250221-ckwmdazrfn
MD5

b3d053d1ba88f51fc0cd0f17a4a1e820
SHA1

9ae69efd73ca49c63fe252ef8bea8559173ddb00
SHA256

152cacd98d23c36d568c7aeac8ab088e97be55fca99f8acc572fb4cb0baf6ad8
SHA512

8e35ab69f78ea56ccbf2a9d7b50fe87bede32ee423b6d544b4a2bc7f70c3f9db53a9d82f410c3f4191699c02d1ee18ea8832bf1951d6e08237cd0791d5f5047b
SSDEEP

12288:wYFMrtB0xmRK2r41cj/OWbl5XGbCyhB3nKalOYH4xIWHzzI6sNTlWe6s+Dw:wYytB0xGP41S/OQl5Byh9nKiOYDWHWd3

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

64.23.156.231:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-HBQ7NT
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  152cacd98d23c36d568c7aeac8ab088e97be55fca99f8acc572fb4cb0baf6ad8.exe
- Size
  
  685KB
- MD5
  
  b3d053d1ba88f51fc0cd0f17a4a1e820
- SHA1
  
  9ae69efd73ca49c63fe252ef8bea8559173ddb00
- SHA256
  
  152cacd98d23c36d568c7aeac8ab088e97be55fca99f8acc572fb4cb0baf6ad8
- SHA512
  
  8e35ab69f78ea56ccbf2a9d7b50fe87bede32ee423b6d544b4a2bc7f70c3f9db53a9d82f410c3f4191699c02d1ee18ea8832bf1951d6e08237cd0791d5f5047b
- SSDEEP
  
  12288:wYFMrtB0xmRK2r41cj/OWbl5XGbCyhB3nKalOYH4xIWHzzI6sNTlWe6s+Dw:wYytB0xGP41S/OQl5Byh9nKiOYDWHWd3
Score

10^/10

guloader remcos remotehost collection discovery downloader rat spyware stealer
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  cff85c549d536f651d4fb8387f1976f2
- SHA1
  
  d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA256
  
  8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- SHA512
  
  531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP
  
  192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  specklessness.doc
- Size
  
  397KB
- MD5
  
  20108545afc650a1f43d483971760f55
- SHA1
  
  1986b56f0dbad72fc093bbb384ae7c9a01efeb95
- SHA256
  
  119e43c5cd9c43ff31e82f9bf6711dd4f488e5a450e1acfcac87c19cc0c6fff7
- SHA512
  
  dd89cfbb13b373d87c144f3788b9e5e037e308c9af45d78f10cd74707d5ce86d91a7a493431be7d4c896cc7f95ee0d48ae5307f46272ddba3d64c910b578bbe8
- SSDEEP
  
  1536:23sQmlZgy2I3m6/jsf63QEbm3VDClp5BFUOWCTcN/aQYdLq/iTv8cTynJB17eJsw:KTyLuCpMrBodKCra6ZM4hJ
Score

3^/10

discovery
behavioral5 behavioral6