General
-
Target
04fb5a1f6082a09a55bec26e0748918da0d1007e2a43c70723dc79cc7c413079
-
Size
103KB
-
Sample
220820-cnq63agaf3
-
MD5
79589e0921954f16e5822a950f23404b
-
SHA1
9e73ddff1e668d721edf73d75061ad690f8a6181
-
SHA256
7e3e042ed65094422db1df8368b2aa34f316a775bf4dbe2982ca03595bc0a408
-
SHA512
97b4055570715041a4fecbb41cc788569d7f36eb90d402115b40f87d638cf0e97b611f55ac064e9109b03b1f07d9599dcbc1bf538797325fc26433f689144144
-
SSDEEP
3072:F5HloKyPuDXWnuiiNi1tq/5OlIriEoXCEYoBWz1:7SpmzJlysOlIriEcCBkw
Malware Config
Extracted
azorult
http://195.245.112.115/index.php
Extracted
remcos
08172022
nikahuve.ac.ug:6968
kalskala.ac.ug:6968
tuekisaa.ac.ug:6968
parthaha.ac.ug:6968
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
scaxs.dat
-
keylog_flag
false
-
keylog_folder
foracbas
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
sdfxyttyvcweghfgfhtd-EE5ET5
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
04fb5a1f6082a09a55bec26e0748918da0d1007e2a43c70723dc79cc7c413079
-
Size
1.1MB
-
MD5
7a1618c1616dae2aa4402b2f9f0febc7
-
SHA1
0864cf603f4e06a32f3ae266a557d14055d4a34a
-
SHA256
04fb5a1f6082a09a55bec26e0748918da0d1007e2a43c70723dc79cc7c413079
-
SHA512
265b51572fd2087e597e49a0f92e48a3469ae177c2751267a3b113e19dbacd2ec5dd10e16e89d4ca0b854a28eae19f70130ff0c133861fee2d7ffa11cf2f0318
-
SSDEEP
3072:CsCrC5C51grFd75sRnuiiNi1tq/5Olg+x7Plk+Bic:41grf2QlysOl5PZf
Score10/10-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-