Overview

overview

10

Static

static

3

BouncyCast...to.dll

windows10-2004-x64

1

BouncyCast...to.dll

windows11-ltsc_2024-x64

1

BouncyCast...hy.dll

windows10-2004-x64

1

BouncyCast...hy.dll

windows11-ltsc_2024-x64

1

Colorful.Console.dll

windows10-2004-x64

1

Colorful.Console.dll

windows11-ltsc_2024-x64

1

DocumentFo...rk.dll

windows10-2004-x64

1

DocumentFo...rk.dll

windows11-ltsc_2024-x64

1

DocumentFo...ml.dll

windows10-2004-x64

1

DocumentFo...ml.dll

windows11-ltsc_2024-x64

1

HOTMAIL CHECKER.exe

windows10-2004-x64

10

HOTMAIL CHECKER.exe

windows11-ltsc_2024-x64

10

Leaf.xNet....le.dll

windows10-2004-x64

1

Leaf.xNet....le.dll

windows11-ltsc_2024-x64

1

Leaf.xNet.dll

windows10-2004-x64

1

Leaf.xNet.dll

windows11-ltsc_2024-x64

1

MailKit.dll

windows10-2004-x64

1

MailKit.dll

windows11-ltsc_2024-x64

1

MimeKit.dll

windows10-2004-x64

1

MimeKit.dll

windows11-ltsc_2024-x64

1

Newtonsoft.Json.dll

windows10-2004-x64

1

Newtonsoft.Json.dll

windows11-ltsc_2024-x64

1

Spectre.Console.dll

windows10-2004-x64

1

Spectre.Console.dll

windows11-ltsc_2024-x64

1

System.Buffers.dll

windows10-2004-x64

1

System.Buffers.dll

windows11-ltsc_2024-x64

1

System.Dia...ce.dll

windows10-2004-x64

1

System.Dia...ce.dll

windows11-ltsc_2024-x64

1

System.For...n1.dll

windows10-2004-x64

1

System.For...n1.dll

windows11-ltsc_2024-x64

1

System.Memory.dll

windows10-2004-x64

1

System.Memory.dll

windows11-ltsc_2024-x64

1

Resubmissions

22/07/2026, 14:21

260722-rn53jsszcv10

22/07/2026, 14:17

260722-rlxcmaff988

Sharing

Copy URL Twitter E-mail

General

  • Target
    Hotmail Checker.zip
  • Size 27.4MB
  • Sample260722-rn53jsszcv
  • SHA256 1074f444ee58c564d3460629c633d2085defa91f403550b7d348fde0e4256b67
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
remus_stealerstealcsvcstealerrunadwarediscoverydownloaderexecutioninstallerpersistencepyinstallerspywarestealer

Malware Config

Extracted

Family

  • svcstealer

C2

  • http://196.251.107.186/acovp/post.php

  • http://192.162.199.186/usovp/post.php

  • http://196.251.107.163/bioxp/post.php

Attributes
  • build_id

    Dropped

  • srv_delay

    1

  • srv_retry

    1

Extracted

Family

  • stealc

Botnet

  • RUN

C2

  • http://196.251.107.163

rc4.plain

Extracted

Family

  • remus_stealer

C2

  • http://zelpx.garden:9895

  • http://fimmora.surf:6504

  • http://tzpx.courses:4437

Targets

    • Target
      BouncyCastle.Crypto.dll
    • Size 2.8MB
    • SHA256 07498b990aa84916ec6d84e24cdf99a0ac0e265ff3e53598a9b153285bd23594
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      BouncyCastle.Cryptography.dll
    • Size 6.6MB
    • SHA256 3f0182309f8ffb9ce0fa5f303219d3155bf1da232e14a620ed234aec209a2935
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      Colorful.Console.dll
    • Size 88KB
    • SHA256 59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      DocumentFormat.OpenXml.Framework.dll
    • Size 464KB
    • SHA256 a9fcdaa61b5b31cbef422836fb30ac273ee89c54edbf8b89f3e70ddf8260638e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      DocumentFormat.OpenXml.dll
    • Size 6.1MB
    • SHA256 3bb9e76daa3bb2f283104b2d019f0b3d50b7597ecc2fe1d9b73d53335a5c2059
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      HOTMAIL CHECKER.exe
    • Size 17.2MB
    • SHA256 c07a5a9f430885a6f0f0666bf416bbaabfb157d47c2f164bd6228c0fc44af72c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    adwarerundiscoverydownloaderexecutionremus_stealerstealcsvcstealerinstallerpersistencepyinstallerspywarestealer

    • Family: Remus

      Remus is a stealer written in C++.

      stealerremus_stealer

    • Family: Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Family: SvcStealer, Diamotrix

      SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

      stealerdownloadersvcstealer

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Suspicious use of SetThreadContext

    behavioral11behavioral12
    • Target
      Leaf.xNet.BouncyCastle.dll
    • Size 12KB
    • SHA256 49733d6dd67273dcb4c70479f80c9e3ce5a8fd5ac7d6cb8ab31e838889c226fa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      Leaf.xNet.dll
    • Size 142KB
    • SHA256 056900c587b7e574ccd154a83fe299bada653347c3862076b0ef6035039c0bec
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      MailKit.dll
    • Size 853KB
    • SHA256 565de1967dda17ebbd4838dc99fcd41e659ebcc50ebe4b9bbb74f3ac0b3e7586
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      MimeKit.dll
    • Size 1.1MB
    • SHA256 edb95f9690afbf7f9123d9954a1073f60d0b2bb4ecb23b88ddfa223cfe653bf3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      Newtonsoft.Json.dll
    • Size 695KB
    • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      Spectre.Console.dll
    • Size 720KB
    • SHA256 26bb8dc1ca36d7ada9979ffc9ddf658ff48068cee0154ac540a8870fa7434359
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      System.Buffers.dll
    • Size 20KB
    • SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      System.Diagnostics.DiagnosticSource.dll
    • Size 34KB
    • SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      System.Formats.Asn1.dll
    • Size 83KB
    • SHA256 d486f07f5fb422ceb8bfba1ad793f248b8f71de2751b9f6123a7e2738e468487
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      System.Memory.dll
    • Size 138KB
    • SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Browser Information Discovery

1
T1217

Network Service Discovery

1
T1046

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

adwarerundiscoverydownloaderexecutionremus_stealerstealcsvcstealerinstallerpersistencepyinstallerspywarestealer
Score
10/10

behavioral12

rundiscoverydownloaderexecutionstealcsvcstealerinstallerpersistencestealer
Score
10/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10