Beware of Weaponized Employee Performance Reports that Deploys Guloader Malware

A phishing campaign distributes Guloader disguised as an employee performance report (NSIS executable inside a RAR named “staff record pdf.exe”) which downloads encrypted shellcode from Google Drive and injects it into memory to deploy Remcos RAT; C2 infrastructure is identified at 196.251.116.219 on ports 2404 and 5000, enabling persistent remote access and data theft.