guloader | f0a2e9f3fc131d22c3d7a03318377de60416b39f2c1ecd6533a5aeaa115030b8

General

Target

f0a2e9f3fc131d22c3d7a03318377de60416b39f2c1ecd6533a5aeaa115030b8.exe
Size

878KB
Sample

250403-qjjs3sw1dw
MD5

b88ac267dbfca8a81de4439036d12c24
SHA1

c48876d33ad00024eeabbfa39cdc681317e24e76
SHA256

f0a2e9f3fc131d22c3d7a03318377de60416b39f2c1ecd6533a5aeaa115030b8
SHA512

a727b4ff87d55bb8800e8a6566c6c6f9e9fb87eb97d447a484a6396a58ec8defa7d1a5cb1a25f8406f5dbecc44a38a47af13bc3562bf742ffd45b3cf21cfbf7e
SSDEEP

12288:JUjfmwszThqQM5rAUgsupiaz15kDdtZQFxj08SiXIql8Wm4y6JgN/i6x:JUjfmNzTMrIpjkDTZQX04F8bZN6A

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

196.251.69.85:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-K5GQZM
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  f0a2e9f3fc131d22c3d7a03318377de60416b39f2c1ecd6533a5aeaa115030b8.exe
- Size
  
  878KB
- MD5
  
  b88ac267dbfca8a81de4439036d12c24
- SHA1
  
  c48876d33ad00024eeabbfa39cdc681317e24e76
- SHA256
  
  f0a2e9f3fc131d22c3d7a03318377de60416b39f2c1ecd6533a5aeaa115030b8
- SHA512
  
  a727b4ff87d55bb8800e8a6566c6c6f9e9fb87eb97d447a484a6396a58ec8defa7d1a5cb1a25f8406f5dbecc44a38a47af13bc3562bf742ffd45b3cf21cfbf7e
- SSDEEP
  
  12288:JUjfmwszThqQM5rAUgsupiaz15kDdtZQFxj08SiXIql8Wm4y6JgN/i6x:JUjfmNzTMrIpjkDTZQX04F8bZN6A
Score

10^/10

guloader remcos remotehost discovery downloader persistence rat
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  8b3830b9dbf87f84ddd3b26645fed3a0
- SHA1
  
  223bef1f19e644a610a0877d01eadc9e28299509
- SHA256
  
  f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
- SHA512
  
  d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
- SSDEEP
  
  192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
Score

3^/10

discovery
behavioral2