Overview

overview

10

Static

static

3

Bootsехеcn64.exe

windows10-2004-x64

10

Bootsехеcn64.exe

windows11-ltsc_2024-x64

10

locales/re...ng.dll

windows10-2004-x64

1

locales/re...ng.dll

windows11-ltsc_2024-x64

1

locales/re...ng.dll

windows10-2004-x64

1

locales/re...ng.dll

windows11-ltsc_2024-x64

1

locales/re...ng.dll

windows10-2004-x64

1

locales/re...ng.dll

windows11-ltsc_2024-x64

1

mpclient.dll

windows10-2004-x64

10

mpclient.dll

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    uploads_Bootsехеcn64.zip
  • Size 6.1MB
  • Sample260729-j2rhba1wfx
  • SHA256 d83ab9a8723e605bc2ef274613f0d3ad63394f6566e740eb9249d5f689e6ba10
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
remus_stealervidaref045f18455132bc2e22c24a3c41c8a9defense_evasiondiscoveryspywarestealertrojan

Malware Config

Extracted

Family

  • remus_stealer

C2

  • http://smarwth.biz:5292

  • http://zelpx.garden:9895

  • http://tzpx.courses:4437

Extracted

Family

  • vidar

Version

  • 1.1

Botnet

  • ef045f18455132bc2e22c24a3c41c8a9

C2

  • https://168.222.97.79

  • https://telegram.me/nwwfh8

  • https://steamcommunity.com/profiles/76561198719385745

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0

Targets

    • Target
      Bootsехеcn64.exe
    • Size 899.8MB
    • SHA256 44b369f8081d6dadf3846349050f614c2c299fcbc43106cc23c9d64195858dbd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryremus_stealerspywarestealer

    • Detects Remus stealer

    • Family: Remus

      Remus is a stealer written in C++.

      stealerremus_stealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware
    behavioral1behavioral2
    • Target
      locales/resources/app.asar.unpacked/node_modules/btime/binding.node
    • Size 118KB
    • SHA256 98c51303c38dc03faeeba13f26fa3c6645d0c1a502b8a5d28177ce015dacf35f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.node
    • Size 125KB
    • SHA256 149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.node
    • Size 118KB
    • SHA256 094bfeb0692885f1e56bb363e1065099eab48a7988c8603fd6a3fb49ec88b09c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      mpclient.dll
    • Size 2.2MB
    • SHA256 3a95e1c2c599e7c27537e42713451e862dcd318660bbc11bbb45f1432f68499c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    ef045f18455132bc2e22c24a3c41c8a9vidarstealerdefense_evasionspywaretrojan

    • Detects Vidar Stealer

      stealer

    • Family: Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    behavioral10behavioral9

MITRE ATT&CK Enterprise v16

Tasks