guloader | dbfc48866b03f8d8141fbdd9f1d67581a9fea0be3198148327c773961da30667

General

Target

dbfc48866b03f8d8141fbdd9f1d67581a9fea0be3198148327c773961da30667
Size

671KB
Sample

250417-f2618ayybs
MD5

1de564902a9bbbbda654fc924f0c8f6d
SHA1

9e184addcecb257404e83018f01b74115dee9b8c
SHA256

dbfc48866b03f8d8141fbdd9f1d67581a9fea0be3198148327c773961da30667
SHA512

865fe486bc3cc4ac8d52a9655a40b32edc99d975d88a5568ea021f6cda3e2529010e4d43fa97f2a5983a75b1cbfde668e3f2cd926ab94c61a2c1ef75e70c204a
SSDEEP

12288:IQiHabJPn/6GK7mBbSHPzqG5rjYr54sdGNxKcPDGEOxp1B1aMf8nqxxuAMdT:IQjbJP/6GKEbqbqp0VTOtB1aMknuxsZ

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

196.251.92.62:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-Q6KAMU
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  2025 Staff Satisfaction Survey.exe
- Size
  
  693KB
- MD5
  
  9e44332968633c219a3207a63bd73d98
- SHA1
  
  c42747558e13f300e05a26e2c545257b29172701
- SHA256
  
  79adf75aed9c95e003d6726b4df5a6f98233e1e2712e39dcbfb02dd479cf4742
- SHA512
  
  42243f0f37db43e16d13c63fd50882a43a1203f36cf71333b082271544950ad839241e00d5dfca219207d35120bcb6bc1a36fb1dd70df8a98ab5789a0a742065
- SSDEEP
  
  12288:BY/aiHIbJPf/kGO7mRbOHnzq05vjYN54edUNxScVDGEOx31BNaMf8nQxehZZY8:BY/aDbJPnkGO6b2zqLe/TOXBNaMknYe3
Score

10^/10

guloader remcos remotehost discovery downloader persistence rat
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  cff85c549d536f651d4fb8387f1976f2
- SHA1
  
  d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA256
  
  8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- SHA512
  
  531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP
  
  192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Score

3^/10

discovery
behavioral3 behavioral4