New Backdoor used against Microsoft Outlook - ComLook

ComLook has 3 hard-coded credentials for Mailboxes. For each inbox, ComLook has a different folder to look for new commands and to upload results. The commands are encrypted. The attacker can execute cmd commands, upload and download files and update ComLook's configuration. All three mail servers seem to be compromised servers where Turla ran its own mail server instance. The communication is encrypted (imaps). Some code hints that past versions were using plain imap. ComLook registers itself in Microsoft Outlook using "The Bat!", similarly to Turla Outlook, but no code similarity was found. According to the submission country and the mail addresses, ClearSky assess with high confidence that the backdoor was used against an Azerbaijani target. The compilation timestamp was changed, but the export table timestamp hints that the binary was compiled on June 2019. Two mail servers seem to be down, and one is not authenticating the hard-coded credentials.