General
-
Target
XDR_ResponseApp_CollectFile_ID00000020_20230220T082136Z.7z
-
Size
360KB
-
Sample
230220-keltzsab72
-
MD5
797178b3449b96f551b36d35dea634b8
-
SHA1
1d57ab59074c0dcfdd46344e3fcb1eb949137464
-
SHA256
e40471f94122edb465dddb424f6f5ad43a1a75ce88f1a1331ff6b83389adc311
-
SHA512
b7f3aafa3376395ce312c801c540bf5c9664b78479110d885361d27f2692b9c41173a0855547dc74c4d75bc2762e513ce44a44005f3f0bf22655896d50a54421
-
SSDEEP
6144:jSQvrYmSunyvOpmxlRTPaylm0iNbj8t7pKbEL4t4RVkXa6myoJYcN45:7vrYmvYOpmJTiX06bjMKbELSsC5mtKj
Malware Config
Extracted
remcos
Feb-AED-2023
pentester01.duckdns.org:53077
pentester0.accesscam.org:56796
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
WeTransfer.exe
-
copy_folder
WeTransfer
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Wetransfer
-
mouse_option
false
-
mutex
Wtr-T1D6TL
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
WeTransfer
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
Drawing.exe
-
Size
38.1MB
-
MD5
557519e86236b452736cd37dd6a911d5
-
SHA1
1cd058ac54ded73f5085b0f77f87848c4004dc92
-
SHA256
062e09ef4557a58115bae71a72ea2d3f7168fb199588c35d1d6e4ef02b7d4e4d
-
SHA512
800fab3177b87046e8a516f6066be5970b0f26bb9a21a66dd10dbf7d5628bc324024700d161b8258a944002c7c23973a71c8938f6ffbe7d3e1f7655c1c15302f
-
SSDEEP
12288:59eu4QUqmzouRvfkK10/ngIlubJA7pXUKPpj1R8P/Wx5QblAc6FgMHOygt:59B4cuRHLkVS8pjTfzClp6FFu/
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
ModiLoader Second Stage
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-