Malware
AndroxGh0st
aka AndroxGhost · Androx
According to Laceworks, this is a SMTP cracker, which is primarily intended to scan for and parse Laravel application secrets from exposed .env files.
AndroxGh0st, also known as AndroxGhost, Androx, is a Python malware family operated by Xcatze.
Background
Laceworks characterizes AndroxGh0st as an SMTP cracker whose main job is locating and extracting Laravel application secrets from exposed .env files. Laravel is an open-source PHP framework, and its .env file is a frequent target because it holds configuration data for services such as AWS, SendGrid, and Twilio. The malware bundles several SMTP-abuse capabilities, including scanning, exploitation of leaked credentials and APIs, and webshell deployment. Where AWS is concerned, it not only locates and parses AWS keys but can also generate keys for brute-force attempts, although that brute-force feature is more of a gimmick and statistically an improbable attack path.
Source: Malpedia (Fraunhofer FKIE).