remus_stealer | 36a4267f1a864626e8df6a69afb6fc84536e21c192e7bb759af1e8b9935269bd

General

Target
0d298a65db890328d0357b2fb39ea7352645a994a601f430c38450769635f957.zip
Size 2.1MB
Sample260804-3fs9katalg
SHA256 36a4267f1a864626e8df6a69afb6fc84536e21c192e7bb759af1e8b9935269bd
MD5 0a3a835f804db39a0c7cc9c474506e73
SHA1 c915f1c0c3cdde34786d1177b302c0eff4286ed8
SHA512 938f5ea4650bebcf3497474b1aa5c7e78b2cc15699242e92c62ca58f9adfae9b92aa97c133d11d3a0078028260b3ee21c8ca70c6224b3074e246590c9c19e4bf
SSDEEP 49152:syGvOCSAtSwEDfvytd+hC2AQaI2Q88B1Y/QzjSkew876:UWCzvErvyriIQa4FB1ckew/
TLSH
T1ECA533D1596CAA61CFE08BA94CD9BE086E41765D9775308681F553BEEFA42F00C823CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

remus_stealer

C2

http://none
http://onesdto.shop:2535
http://slyfogx.shop:5776

Targets

- Target
  0d298a65db890328d0357b2fb39ea7352645a994a601f430c38450769635f957.zip
- Size 2.1MB
- SHA256 36a4267f1a864626e8df6a69afb6fc84536e21c192e7bb759af1e8b9935269bd
- MD5 0a3a835f804db39a0c7cc9c474506e73
- SHA1 c915f1c0c3cdde34786d1177b302c0eff4286ed8
- SHA512 938f5ea4650bebcf3497474b1aa5c7e78b2cc15699242e92c62ca58f9adfae9b92aa97c133d11d3a0078028260b3ee21c8ca70c6224b3074e246590c9c19e4bf
- SSDEEP 49152:syGvOCSAtSwEDfvytd+hC2AQaI2Q88B1Y/QzjSkew876:UWCzvErvyriIQa4FB1ckew/
- TLSH
  T1ECA533D1596CAA61CFE08BA94CD9BE086E41765D9775308681F553BEEFA42F00C823CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion remus_stealer stealer themida trojan
- Detects Remus stealer
- Family: Remus
  Remus is a stealer written in C++.
  stealer remus_stealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Remus stealer

Family: Remus

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Executes dropped EXE

Themida packer

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2