guloader | ce7a25f25c13cb9baea92707f76f9f212c1551e6c7dc5e4ec075f9e159c1b5c3

General

Target

PerformanceReport.bat.exe
Size

598KB
Sample

250407-tdxpjaxms5
MD5

f580a951ed1da5de9bd9f16956fc3546
SHA1

6364a4411b6a5f707aabd37223a1fc96c387f242
SHA256

ce7a25f25c13cb9baea92707f76f9f212c1551e6c7dc5e4ec075f9e159c1b5c3
SHA512

c38638eca1d617f3ec0101f08088532c102e919766ee781401ea3529b4bf729aba3a1643a37e0ad2c9a107a36e13c1e7a4beb1efa858d6d6e33d5eebf25f58d5
SSDEEP

12288:ctoOoMm0fx42zlTMI0QM8KyFHsmUY5Mj5ckvQGtGeNStTZfgZjT0gRhgL:NOoMm0fWPl8KGsm7y5ctc6CZjTFgL

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

196.251.86.242:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-KE9TKG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  PerformanceReport.bat.exe
- Size
  
  598KB
- MD5
  
  f580a951ed1da5de9bd9f16956fc3546
- SHA1
  
  6364a4411b6a5f707aabd37223a1fc96c387f242
- SHA256
  
  ce7a25f25c13cb9baea92707f76f9f212c1551e6c7dc5e4ec075f9e159c1b5c3
- SHA512
  
  c38638eca1d617f3ec0101f08088532c102e919766ee781401ea3529b4bf729aba3a1643a37e0ad2c9a107a36e13c1e7a4beb1efa858d6d6e33d5eebf25f58d5
- SSDEEP
  
  12288:ctoOoMm0fx42zlTMI0QM8KyFHsmUY5Mj5ckvQGtGeNStTZfgZjT0gRhgL:NOoMm0fWPl8KGsm7y5ctc6CZjTFgL
Score

10^/10

guloader remcos remotehost discovery downloader persistence rat
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  ca332bb753b0775d5e806e236ddcec55
- SHA1
  
  f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
- SHA256
  
  df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
- SHA512
  
  2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
- SSDEEP
  
  192:eo24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol6Sl:k8QIl975eXqlWBrz7YLOl6
Score

3^/10

discovery
behavioral2