guloader | bc07663dd2914cb55cd9ec17a9e2e751f1903ccfd61727494403a6ea565d1f60

General

Target

REQUEST QUOTATION ORDER PO17988857 Carlssoon Technologies.exe
Size

594KB
Sample

250417-f8zkqayyev
MD5

7dc2d6abf1444596ae6344aad1738740
SHA1

eb01b9ea5342bf67106fff594fdaefdf69b3a271
SHA256

bc07663dd2914cb55cd9ec17a9e2e751f1903ccfd61727494403a6ea565d1f60
SHA512

81986303fc26aba1b8b7497f7bca57f7f2a39d9fdaa4a49e1da6fafe7bbbfc281896942f70a3db6ab562c450f43769ac60193d14054469119bc6e510e4b03204
SSDEEP

12288:l5TLXTKZmsAYgRNLZ3ABJyN/79p5gHvZ2aMtAlKVjedx2cNb3io6W4w:v/AmszgRNLZwBJyt79p0vBM+MdedUezx

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

23.95.235.13:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-ONO9ZA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  REQUEST QUOTATION ORDER PO17988857 Carlssoon Technologies.exe
- Size
  
  594KB
- MD5
  
  7dc2d6abf1444596ae6344aad1738740
- SHA1
  
  eb01b9ea5342bf67106fff594fdaefdf69b3a271
- SHA256
  
  bc07663dd2914cb55cd9ec17a9e2e751f1903ccfd61727494403a6ea565d1f60
- SHA512
  
  81986303fc26aba1b8b7497f7bca57f7f2a39d9fdaa4a49e1da6fafe7bbbfc281896942f70a3db6ab562c450f43769ac60193d14054469119bc6e510e4b03204
- SSDEEP
  
  12288:l5TLXTKZmsAYgRNLZ3ABJyN/79p5gHvZ2aMtAlKVjedx2cNb3io6W4w:v/AmszgRNLZwBJyt79p0vBM+MdedUezx
Score

10^/10

guloader discovery downloader remcos remotehost persistence rat
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  ee260c45e97b62a5e42f17460d406068
- SHA1
  
  df35f6300a03c4d3d3bd69752574426296b78695
- SHA256
  
  e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27
- SHA512
  
  a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3
- SSDEEP
  
  192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
Score

3^/10

discovery
behavioral3 behavioral4