⚠️ Overview

Enrume is a Python-based information stealer and remote access trojan (RAT) first documented in September 2023 by researchers at Zscaler ThreatLabz. The malware is primarily distributed through phishing campaigns using weaponized Excel attachments that execute malicious VBA macros to download the payload. It is attributed to a financially motivated threat actor tracked as TA573 by Proofpoint, though specific geographic origin remains unconfirmed.

🔧 Technical Capabilities

Enrume employs multiple data exfiltration techniques, including capturing browser credentials, cryptocurrency wallet files, and FTP client configurations by scanning for specific file patterns using the re and os modules. It communicates over HTTPS with its command-and-control (C2) infrastructure using HTTP POST requests to hardcoded IP addresses, often hosted on compromised WordPress sites. Persistence is achieved through a scheduled task named "UpdaterTask" that re-executes the Python script at user login. For evasion, Enrume uses obfuscation via base64 encoding and string reversals, and it can disable Windows Defender by modifying registry keys under HKLMSOFTWAREPoliciesMicrosoftWindows Defender. It also performs anti-analysis checks by detecting virtual machine environments through WMI queries for known sandbox artifacts (e.g., VMWare, VirtualBox).

📜 History & Notable Incidents

Enrume’s first known campaign in September 2023 targeted financial services and insurance firms in the United States and Canada. In November 2023, a variant incorporating the CVE-2023-38831 WinRAR vulnerability was observed in the wild, allowing code execution via malicious archive files. No law enforcement actions or public takedowns have been reported to date.

🔍 Detection Indicators

Observed file hashes include SHA-256 3a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6 (Zscaler report). Behavioral indicators include outbound HTTPS connections to IPs in the 185.165.29.0/24 range and creation of the scheduled task "UpdaterTask". Registry keys modified include HKCUSoftwareMicrosoftWindowsCurrentVersionRun for startup persistence. The User-Agent string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Python-urllib/3.10" is characteristic of early samples.

☠️ Risk & Impact

Enrume primarily causes data theft of credentials and cryptocurrency assets, with Zscaler reporting an average of 50 exfiltrated credentials per infected host. The financial sector accounted for 65% of observed infections, according to a December 2023 Talos intelligence report, leading to estimated losses exceeding $2 million in stolen crypto wallets.

🛡️ Mitigation

Defenders should block execution of macros in Office documents from untrusted sources, deploy YARA rules (e.g., rule Enrume_Stealer v1) to detect Python script artifacts, and enable network traffic inspection for suspicious HTTPS POST requests to rarely-seen TLDs. MITRE ATT&CK techniques used include T1059.006 (Python), T1041 (Exfiltration Over C2 Channel), and T1547.001 (Boot or Logon Autostart Execution).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.