Overview

overview

10

Static

static

3

gc.dll

windows10-2004-x64

10

User tags

Assigned on submission by the user, not by sandbox detections.

ClearFake

Sharing

Copy URL Twitter E-mail

General

  • Target
    gc.key
  • Size 6.3MB
  • Sample260714-xtbc1sby6k
  • SHA256 abc81d4d4b22d8388e829f3fedeb35cb3d3a7e50a108ba1ac779161b21a5bad3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
remus_stealerdiscoveryspywarestealer

Malware Config

Extracted

Family

  • remus_stealer

C2

  • http://zelpx.garden:9895

  • http://tzpx.courses:4437

  • http://carogra.biz:4219

Targets

    • Target
      gc.key
    • Size 6.3MB
    • SHA256 abc81d4d4b22d8388e829f3fedeb35cb3d3a7e50a108ba1ac779161b21a5bad3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryremus_stealerspywarestealer

    • Detects Remus stealer

    • Family: Remus

      Remus is a stealer written in C++.

      stealerremus_stealer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks