guloader | 84cbc04ddb1c58b28691436783451a95a21752eae4b59bd964f5e3320c4e866e

General

Target

MARCH PAY SLIP_PDF.exe
Size

893KB
Sample

250404-a7149sxtdw
MD5

ac92b521eda00eb291dda0534f497b1f
SHA1

3fa2aa0bcd5481fc748bfc22cf03bed57f7a8b39
SHA256

84cbc04ddb1c58b28691436783451a95a21752eae4b59bd964f5e3320c4e866e
SHA512

e374ad43b713fe46819e1421aeb16f7040870f236ed54053a25bd1ee7d9eddd1cf8c9d72682a04ba60e8bf47b7b7302f101498c49e8c82be5b3ddf99180a0f89
SSDEEP

24576:6YineNXPiXtlnnKGfG4rAF5NecpSHTljnMD6vXU:HGgPc/65Nj8H5jMD4E

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

196.251.86.105:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-MJDICZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  MARCH PAY SLIP_PDF.exe
- Size
  
  893KB
- MD5
  
  ac92b521eda00eb291dda0534f497b1f
- SHA1
  
  3fa2aa0bcd5481fc748bfc22cf03bed57f7a8b39
- SHA256
  
  84cbc04ddb1c58b28691436783451a95a21752eae4b59bd964f5e3320c4e866e
- SHA512
  
  e374ad43b713fe46819e1421aeb16f7040870f236ed54053a25bd1ee7d9eddd1cf8c9d72682a04ba60e8bf47b7b7302f101498c49e8c82be5b3ddf99180a0f89
- SSDEEP
  
  24576:6YineNXPiXtlnnKGfG4rAF5NecpSHTljnMD6vXU:HGgPc/65Nj8H5jMD4E
Score

10^/10

guloader remcos remotehost discovery downloader persistence rat
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  cff85c549d536f651d4fb8387f1976f2
- SHA1
  
  d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA256
  
  8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- SHA512
  
  531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP
  
  192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score

3^/10

discovery
behavioral2