General
-
Target
f29f6dc54c33b2aae2950019ee54b04c.exe
-
Size
831KB
-
Sample
230113-whe2dsbb83
-
MD5
f29f6dc54c33b2aae2950019ee54b04c
-
SHA1
c37d98a04edbe68fbd4e054fe0e96b1c926460ea
-
SHA256
8c5df030de0c79f2155a60e0d5f41889ec8d07d441279d406996dca4639f8539
-
SHA512
3205deea23d0655968935d26028e895d10b82594afc0ce17a5e2454a4c50584dc11564f0f1acf46ec0cc41dc0b6d3e638803934649f5834c75b04e708473967c
-
SSDEEP
24576:Mf78hVkC6gGhgfyNbpiODGsSm+FGUz9q:MAhf6gGhgab6shWz
Malware Config
Extracted
raccoon
75ea4cb7f040eb3056eaa4e86a3a9d6c
http://91.215.85.146/
Extracted
azorult
http://195.245.112.115/index.php
Extracted
remcos
1122023
nikahuve.ac.ug:65214
kalskala.ac.ug:65214
tuekisaa.ac.ug:65214
parthaha.ac.ug:65214
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
vgbvfxs.dat
-
keylog_flag
false
-
keylog_folder
fsscbas
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
fdsgsdmhj-9K01C1
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Targets
-
-
Target
f29f6dc54c33b2aae2950019ee54b04c.exe
-
Size
831KB
-
MD5
f29f6dc54c33b2aae2950019ee54b04c
-
SHA1
c37d98a04edbe68fbd4e054fe0e96b1c926460ea
-
SHA256
8c5df030de0c79f2155a60e0d5f41889ec8d07d441279d406996dca4639f8539
-
SHA512
3205deea23d0655968935d26028e895d10b82594afc0ce17a5e2454a4c50584dc11564f0f1acf46ec0cc41dc0b6d3e638803934649f5834c75b04e708473967c
-
SSDEEP
24576:Mf78hVkC6gGhgfyNbpiODGsSm+FGUz9q:MAhf6gGhgab6shWz
Score10/10-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-