guloader | edc3f3398feb2bd97457a5da5b03c5438fd385baaae78c8c5f62bfde8bd1e768

General

Target
edc3f3398feb2bd97457a5da5b03c5438fd385baaae78c8c5f62bfde8bd1e768.exe
Size 348KB
Sample251208-svd33sdr31
SHA256 edc3f3398feb2bd97457a5da5b03c5438fd385baaae78c8c5f62bfde8bd1e768
MD5 f0a3602e3f587b3955ca5f34c589b288
SHA1 8567b39a0fc68c41f468c04f282e2ad82bded5f5
SHA512 86c07fb104e55bf5270e2f96af3412ee689487b111782f541d20b0792e9722735457fd937afdba6e60bd66693b8149bc9841d25b6bfccde041adcee08a6336fd
SSDEEP 6144:snPdudwD6P/uU4fGi1A2VS2NGxbkS12m3oQO0az3VvAXs7tyVnbRk:snPdGPaAEgIg2mZO0a9cKtV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

remcos

Version

7.1.0 Pro

Botnet

RemoteHost

C2

91.231.222.23:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-PBL6H9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  edc3f3398feb2bd97457a5da5b03c5438fd385baaae78c8c5f62bfde8bd1e768.exe
- Size 348KB
- SHA256 edc3f3398feb2bd97457a5da5b03c5438fd385baaae78c8c5f62bfde8bd1e768
- MD5 f0a3602e3f587b3955ca5f34c589b288
- SHA1 8567b39a0fc68c41f468c04f282e2ad82bded5f5
- SHA512 86c07fb104e55bf5270e2f96af3412ee689487b111782f541d20b0792e9722735457fd937afdba6e60bd66693b8149bc9841d25b6bfccde041adcee08a6336fd
- SSDEEP 6144:snPdudwD6P/uU4fGi1A2VS2NGxbkS12m3oQO0az3VvAXs7tyVnbRk:snPdGPaAEgIg2mZO0a9cKtV
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

remotehost collection discovery downloader guloader remcos persistence rat
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView
  Password recovery tool for various email clients
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
  collection
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- MD5 4add245d4ba34b04f213409bfe504c07
- SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
- MD5 1d8f01a83ddd259bc339902c1d33c8f1
- SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
- SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
- SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6