2020-04-10 - malpsam pushes GuLodader/NanoCore RAT

2020-04-10 - WETRANSFER-THEMED MALSPAM PUSHES GULOADER/NANOCORE RAT

NOTES:

- The email is not from WeTransfer (sending info is spoofed).
- The link in the malspam for GuLoader is a OneDrive URL.
- The follow-up download caused by GuLoader is from a Google Drive URL.

EMAIL HEADERS:

Received: from hwsrv-700119.hostwindsdns.com ([23.254.209.123]) by [removed] for [removed];
        Fri, 10 Apr 2020 17:30:50 +0000 (UTC)
Received: from wetransfer.com (localhost [127.0.0.1])
	by hwsrv-700119.hostwindsdns.com (Postfix) with ESMTP id B6FAA7C549
	for [removed]; Fri, 10 Apr 2020 17:00:47 +0000 (UTC)
Date: 10 Apr 2020 10:00:47 -0700
Subject: jenny@mail.djgroup.com.tw sent you files via WeTransfer
From: We Transfer <noreply@wetransfer.com>
To: [removed]
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html

FILES:

- SHA256 hash: 52abbaf6e1ebf8e3c1b5e2924da7249662870e138c67ae43105bceb6623e67f9
- File size: 24,628 bytes
- File name: Doc0001.tbz2
- File location: hxxps://onedrive.live[.]com/download?cid=55FF3579FF543F52&resid=55FF3579FF543F52%211825&authkey=AOMq_KOJD8j1mcc
- File description: Zip archive from link in WeTransfer-themed malspam
- File analysis: https://app.any.run/tasks/43e5647d-cbce-4ff0-8723-0d1869a45798/

- SHA256 hash: f0c5aa7b83560d5919f42af93fc4bd6f59431fe7462b83344bca5ed8ea36b6b3
- File size: 98,304 bytes
- File name: Doc0001.exe
- File description: Windows executable file for GuLoader
- File analysis: https://app.any.run/tasks/d941e322-7494-423c-bd69-85f0768214f0/

- SHA256 hash: 38a89b54e9cda85882b47a1e0dd42e9dc250354c2a8d7c1f2fc42f964f6205ef
- File size: 207,936 bytes
- File name: stub_encrypted_DC047FF.bin
- File location: hxxps://drive.google[.]com/uc?export=download&id=1X32M_IHARzUKk1F_zJ3RiwIINMNdw_xR
- File description: Encrypted binary used by GuLoader for NanoCore RAT

IP ADDRESSES AND DOMAINS FOR NANOCORE RAT POST-INFECTION TRAFFIC:

- 185.140.53[.]29 port 4001 - mbills147.ddns[.]net
- 185.244.30[.]247 port 4001 (no domain name)