General
- Target skelethrone_LIGHT_sandbox.zip
- Size 28.7MB
- Sample260620-g53cwaez5v
- SHA256 08180b268dd215d80223d386f4fec69f8ff3084e776ac1067e519c7c80a13b8a
Malware Config
Extracted
-
hijackloader
-
directory
%APPDATA%\MS_stable
-
inject_dll
%windir%\SysWOW64\input.dll
Extracted
-
remus_stealer
-
http://derelb.shop:3781
-
http://carogra.biz:4219
-
http://myrtler.biz:9549
Targets
-
- Target Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
Score10/10-
Detects HijackLoader (aka IDAT Loader)
-
Detects Remus stealer
-
Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
-
Family: Remus
Remus is a stealer written in C++.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
- Target data/python-packages/sys_config/__init__.py
- Size 909B
- SHA256 17f4ebba28743c254c0dd01f8610f7d83069fba06983cf0b37a88798118d707f
Score3/10 -
- Target data/python-packages/sys_config/access_internet.py
- Size 1KB
- SHA256 7455a23af34a963b633b9a95c27929120e1ac126eafa55f814a6fdb854052aa8
Score3/10 -
- Target data/python-packages/sys_config/sys_check.py
- Size 6KB
- SHA256 fbabc2fdbd739e86a870c74329bf6f474e0af0b04f30500243a4379f1bfe4fc0
Score3/10 -
- Target data/python-packages/sys_config/sys_file.py
- Size 17KB
- SHA256 8ca9b86d60a340218c55cdebe94c200aeb87016dc2f6a29c55553d4d4f6509af
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target data/python-packages/sys_config/sys_spec.py
- Size 21KB
- SHA256 92a30f9fe860906e505eeabc97f63d0f26dee956af64c98b864541360be4fc1e
Score3/10 -
- Target lib/py3-windows-x86_64/d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
Score1/10 -
- Target lib/py3-windows-x86_64/libEGL.dll
- Size 436KB
- SHA256 b20c1e14e42da55c13dad3c23a5060ca086eaf5b18b12ef5c60cd7e80276a9f2
Score1/10 -
- Target lib/py3-windows-x86_64/libGLESv2.dll
- Size 6.3MB
- SHA256 2d171e91e1fe7205b76dd69ba9f7ddce7910283a5a5111c09c84f5db8c795a74
Score1/10 -
- Target lib/py3-windows-x86_64/libpython3.9.dll
- Size 8.3MB
- SHA256 ff051213109bca8ae55d458c3eb8c9c0aae12a765ecbb45e6b4b20d4b97b8da7
Score1/10 -
- Target lib/py3-windows-x86_64/librenpython.dll
- Size 18.2MB
- SHA256 29d7304930809804502f331e47d06b72f07b3a1569eb29e0a12dbc71932915d6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target lib/py3-windows-x86_64/libwinpthread-1.dll
- Size 344KB
- SHA256 00d784e7e002c1b01f3146c87f30030f169843988f87c9631cb2df211979286b
Score1/10 -
- Target lib/py3-windows-x86_64/nvdrs.dll
- Size 14KB
- SHA256 068b0c02c881a5d8587a24929e30d8c596305543ae6da5f264f8230a2e45d300
Score1/10 -
- Target lib/py3-windows-x86_64/python.exe
- Size 101KB
- SHA256 652f72976536214578a6ef848d7359495e02db58846d15ea3a85e90ef1040dc9
Score1/10 -
- Target lib/py3-windows-x86_64/pythonw.exe
- Size 101KB
- SHA256 092c282f21cdedf3d533dfbc3c77401856de863833904fc09a1d3668e8d50181
Score1/10 -
- Target lib/python3.9/__future__.pyc
- Size 4KB
- SHA256 791de268946ce6bca07aea7fb44c9ad0172b374bea4b290c38fa6e9c1efd5e44
Score3/10 -
- Target lib/python3.9/_bootlocale.pyc
- Size 1KB
- SHA256 9858005ffc5e24dbd8c8324aa7a1c677da5f4d256da7970053cf8320ddd295b9
Score3/10
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
4Remote System Discovery
1System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1