Guloader Malware Being Disguised as Employee Performance Reports

AhnLab ASEC identified a phishing campaign delivering Guloader via a RAR attachment named "staff record pdf.exe" (disguised as a PDF). The loader downloads shellcode from a Google Drive URL and deploys Remcos RAT (C2: 196.251.116.219:2404,5000), providing remote access and data-theft capabilities (keylogging, screenshots, browser credential theft). The report includes the malware MD5 (c95f2a7556902302f352c97b7eed4159), the download URL, and guidance to exercise caution with email attachments and change passwords.