General

  • Target

    zxcvb.bin.zip

  • Size

    1.0MB

  • Sample

    220707-ftg25addgj

  • MD5

    76d4e146ecee1fa6d238cabccefaddc0

  • SHA1

    6278515d89e60fd864358a8d4673fae83999cb83

  • SHA256

    47785efac13a140e2b016324a9b67604bcdb58a2bd140ece780790e063f1f2c0

  • SHA512

    1f23923fa6420e8271749a29ac2a9f538508fb923c987657a675f61eb528ecd9bae8244668c0fb20e7b4968c4fbbc7e7514f7274f8527619899c4b883eea3411

Malware Config

Extracted

Family

raccoon

Botnet

5f3e2ed386ddeccffbb4e34c56fc2efd

C2

http://193.106.191.146/

http://185.215.113.89/

rc4.plain
rc4.plain

Extracted

Family

arkei

Botnet

Default

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

remcos

Botnet

06192022

C2

nikahuve.ac.ug:6968

kalskala.ac.ug:6968

tuekisaa.ac.ug:6968

parthaha.ac.ug:6968

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    scxs.dat

  • keylog_flag

    false

  • keylog_folder

    forbas

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    cvxyttydfsgbghfgfhtd-RXTSAM

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Targets

    • Target

      zxcvb.bin

    • Size

      1.0MB

    • MD5

      01e485104be49a9f059e6b591273bcd1

    • SHA1

      9dd25e5caa3d591537f519f6a9d0c76e1202451f

    • SHA256

      6887d3d4d5baa135418c2305915c56b448960d03c427f6c63c430465ddaa6547

    • SHA512

      6cb26da4a899889aba0647ec33d6c44a2c05060c8f9753259f29fdebc6b03808d0f9262207a48026f2aef96c35a51d331c04d71fbf4d45a2405ebec8bee6f5a7

    • Arkei

      Arkei is an infostealer written in C++.

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

    • suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4

      suricata: ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4

    • suricata: ET MALWARE Generic Stealer Config Download Request

      suricata: ET MALWARE Generic Stealer Config Download Request

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15

      suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15

    • suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

      suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

    • suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

      suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

1
T1005

Tasks