General
-
Target
XDR_ResponseApp_CollectFile_ID00000021_20230220T082205Z.7z
-
Size
360KB
-
Sample
230220-kfr3dshf8y
-
MD5
eac042ad2e62c99e7fdb1f7490198c8a
-
SHA1
01e22157ced06d3d70bd5a2b160e86c5f3f45244
-
SHA256
7b977c0aede71c9d61e8659f07989a9b6475d0a7b09a16f4612918eb4bd72c62
-
SHA512
ca3763d8982a55c354282d3044d61000052a28e66eb9199b99428db7ea7fd1c7e704168495a019d3865326fe6124a9aa95be02b1048c6de0cb1e08426a5636e5
-
SSDEEP
6144:Z3/G18jhLM9hepMZFvyt38i0vX0yC/3JWf/0ceWB5hg4nO6nV4OHVphCLtCTrE3y:dJj5M9fZFvytMiHT/ZWX02B3gxoVnVph
Malware Config
Extracted
remcos
Feb-AED-2023
pentester01.duckdns.org:53077
pentester0.accesscam.org:56796
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
WeTransfer.exe
-
copy_folder
WeTransfer
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Wetransfer
-
mouse_option
false
-
mutex
Wtr-T1D6TL
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
WeTransfer
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
Specifications.exe
-
Size
37.2MB
-
MD5
a2407b5450ae9e9c2e9cd2ce23b730f2
-
SHA1
050c50124c3728b8e32b1d0ee3ac7051ef062f72
-
SHA256
21586473125a0d4814ec8cfc1c09a310889f9f1fc9002eb75ff84e98fb4ff22a
-
SHA512
f82e2ab6dabf9491543b490f66a0f464edd17529e3b455364993094398d3423f73ef561082054ca2c176739f23d70bcd01d257bc4d967ab935ac44cecbff4809
-
SSDEEP
12288:59eu4QUqmzouRvfkK10/ngIlubJA7pXUKPpj1R8P/Wx5QblAc6FgMHOygt:59B4cuRHLkVS8pjTfzClp6FFu/
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
ModiLoader Second Stage
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-