General
-
Target
2fc0f46e2ceded0b284d4f41759de65e73532900202260b98769ebfaf3244951
-
Size
315KB
-
Sample
221128-eeykwsgg7s
-
MD5
651527b67909e8e82523d5d4a65900a0
-
SHA1
94df7453c78f3d4b1959607a74759f93f26baa0a
-
SHA256
dcf189a5b8f2e4a34d9aa59198376c8b072e08bc46ca044a81b7f8a12c51782b
-
SHA512
1ff6901e081cc792d57ace9deefafdade6699e59300832490e00e2401d6a9865d28bb3bab61d6f32d3ef75ab1002836362c741fbcbd6c9d546d9fa8bcf22cf35
-
SSDEEP
6144:jPZpOOaTvL6p+1+Ud4xajiuzopB9Rdm1pRjWBk0OVpWy8RS:jPnOzTvL6ZW48jiu8pB9RdmpRqBk0Y4S
Static task
static1
Behavioral task
behavioral1
Sample
2fc0f46e2ceded0b284d4f41759de65e73532900202260b98769ebfaf3244951.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2fc0f46e2ceded0b284d4f41759de65e73532900202260b98769ebfaf3244951.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
raccoon
5d704573a0f97fb52a93667085c18b77
http://193.106.191.150/
Extracted
azorult
http://195.245.112.115/index.php
Extracted
remcos
11262022
nikahuve.ac.ug:65214
kalskala.ac.ug:65214
tuekisaa.ac.ug:65214
parthaha.ac.ug:65214
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
vbfxs.dat
-
keylog_flag
false
-
keylog_folder
fsscbas
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
dchfgsdmhj-JWMVH4
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
2fc0f46e2ceded0b284d4f41759de65e73532900202260b98769ebfaf3244951
-
Size
912KB
-
MD5
b417d6f0345b7af1f5dfe584978d8546
-
SHA1
00e67099c87df3f1548793400b1193e423b2de18
-
SHA256
2fc0f46e2ceded0b284d4f41759de65e73532900202260b98769ebfaf3244951
-
SHA512
5a27af515f5913e59c754f49fffae145a76cf540ec4c2b460f08e8b5cd44a53f672b6fb42c845423d2c9ef03170e233d3c1a8ce9273f2a426375b526cd6f9b0c
-
SSDEEP
12288:OMBxceTvLcZWyM5h8pB9RdmpdKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKL:OuCeTAAyD9RdN9P9m
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-