General
-
Target
XDR_ResponseApp_CollectFile_ID00000016_20230220T080423Z.7z
-
Size
364KB
-
Sample
230220-j5n7csab45
-
MD5
c286a04c929995e0d7bc9e1fd6962e5e
-
SHA1
c128931b5b6451e7fde264c574a720419ee88268
-
SHA256
971709cae1eba506c4276b8fa1bc456ec4ac74f6c4a7a97c3f81a1a86ba94348
-
SHA512
97d4c13925ac89bae29a77bf942f63d3cf030b8d3b71b5f29bdf24e1b7045aa31fec49a9ad73ef885321df3778e0e11533311bce8574845603061a49d6567e75
-
SSDEEP
6144:5rOYHMC69iPpAF/jgtN+8qxmU96jrBNlm0vj8dYNwjFPguyakCXvn20MjpXvvv:FvMC9AFS+8q0q6XBr7vjYpyaXXv20GX/
Malware Config
Extracted
remcos
Feb-AED-2023
pentester01.duckdns.org:53077
pentester0.accesscam.org:56796
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
WeTransfer.exe
-
copy_folder
WeTransfer
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Wetransfer
-
mouse_option
false
-
mutex
Wtr-T1D6TL
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
WeTransfer
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
Yfnrxjtz.exe
-
Size
40.1MB
-
MD5
ada8e3c4cf912f0d95b90bcba4c35bf9
-
SHA1
2c3dd9fb668c241b7155cf35afd4b570d74fc436
-
SHA256
e9b31a5fc7aeb80fb74a0d2c1a09037a3147a971eec398b0b49340fbac7c70ae
-
SHA512
b315989a8d5fecc0392432468e54f8e8cf11ec2878637998d379f41a4fae40d8fbeb44f4fa7c1de8d17c3f06610318621c5f4baa6c6849eea31f6bf52d26b13b
-
SSDEEP
12288:09eu4QUqmzouRvfkK10/ngIlubJA7pXUKPpj1RgL7/Wx5QblAc6FgMHOygt:09B4cuRHLkVS8pjTDzClp6FFu/
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
ModiLoader Second Stage
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-