remus_stealer | 0ae4c6180bc24c0c9a02b180e241ce3212c0a920d1e83eacf739ed6b08c8c7aa

Sharing

Copy URL Twitter E-mail

General

Target
uploads_Bootsехеc=64.zip
Size 6.2MB
Sample260804-bpg44sek8z
SHA256 0ae4c6180bc24c0c9a02b180e241ce3212c0a920d1e83eacf739ed6b08c8c7aa
MD5 597cbfa1f6e05561603b0451653505c5
SHA1 46a21008eeadc989ece01a51a5c4aac609a45bd1
SHA512 32ceedb30f3105c457008ba92746da622ed022daded23b7e5831c5f561175df28f03b58ed91f3eeec05ef3c2a8d0fcb0533ef4e4e3dce8dd952da641b81e65d1
SSDEEP 98304:OY1ArVL+7RH/IXozAA3vmAnel0TI2mEn3fYMYzrL/n/YrydjEAZLrx10Nc6Z1S7Z:1CxX4m2e2TPD3fgrL//YryLrT0K6ZaZ
TLSH
T17D6633BC5E542D60986BB6B56D2413E7CF7C9AF1BBA33E04292E38E5101A7BB17D1304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

remus_stealer

http://resghjs.click:7647
http://onesdto.shop:2535
http://azurhay.shop:8539

Extracted

Family

vidar

Version

Botnet

ef045f18455132bc2e22c24a3c41c8a9

https://168.222.97.79
https://telegram.me/nwwfh8
https://steamcommunity.com/profiles/76561198719385745

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0

Targets

- Target
  Bootsехеc=64.exe
- Size 894.1MB
- SHA256 092167a4ee19c3ef32d8657cd0b467f16a65bd38fdffc63821619782ba81f296
- MD5 f7d3bafa96021aeac8c4db6dcc720baf
- SHA1 b80c6fba7115f885551b450955ce4235c7d827d3
- SHA512 f285fcaade6177ac1897458add800357e3e1f56c5071d1ecfde59af6eb27dab6eaa1d91d0dee3911892c4fe611a1cfd9583e376f02ba22da025619d1382c477a
- SSDEEP 49152:B/QvbQIXe2I1D0PzzgfokFs6vG58XdFjkIVmWhA05GJRO9a/ND7YksO+Tr+upG9C:BG5qOy3mWhB5
- TLSH
  T1BFA94917AE9148FAC599E731C8B74215BA74B80D4B3123D32EA1BEB82F327C15E35B54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery remus_stealer spyware stealer themida trojan
- Detects Remus stealer
- Family: Remus
  Remus is a stealer written in C++.
  stealer remus_stealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  locales/resources/app.asar.unpacked/node_modules/btime/binding.node
- Size 118KB
- SHA256 98c51303c38dc03faeeba13f26fa3c6645d0c1a502b8a5d28177ce015dacf35f
- MD5 13a2579ed95366185a6247c9e4b9f0cc
- SHA1 61fef12da622484e44b3c9ddcd61706c9af00aa0
- SHA512 7aae5a45f5333355c81e4a7468d40c9d814a1b242c99a39747fea9b66e277dd1060bda290fc980e958beccab2ac0232fc4aba078426ac5ae39c19968ae8f58d0
- SSDEEP 1536:OMwHUFyUCyB7KdX2teZOpSPtvdO+tYLZI2mAq+J6sWyd09dlgh7tBrdO6t2:hwjUCyB7eC8OpSS+tYLZI5+NMKFdO6t
- TLSH
  T1ECC36C57B2E541BFD4768278C9930A45D3B2B82507309BDF07A4425A1F237E1AE3EB72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.node
- Size 125KB
- SHA256 149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c
- MD5 eeb1d1ea9fc3f870f292161cfa79850d
- SHA1 ea4f4324245f9f4d6280ef285151f688221d6023
- SHA512 795269fba2737ca51d61bb0f6e674c8ed45f2590a48d1dbc53adae9a85b5565e372de6e2a888f038660173f6f4fe0ecda293c441415296e79097c261c452f254
- SSDEEP 3072:cd5+N3E2MosoJCakr0dHPAMMMtrAfz9MrRAG:yIxMQQakr0xPSfzirqG
- TLSH
  T1E4C35B1B73A440BBE4778179C8531A05E772B8610B71DBDF07A0429A1F637E1AE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.node
- Size 118KB
- SHA256 094bfeb0692885f1e56bb363e1065099eab48a7988c8603fd6a3fb49ec88b09c
- MD5 6c12c930f974e5bc7872b58964f42359
- SHA1 805c5c899c32535d2ee8b2bc12deefe5fdaae566
- SHA512 f46c416e3f33e0526c2d4cb3df738f7c9b11fece350b90ca9613e5d86bae7a363dd20b80d62f5745a9d51773b655199537b09fcf47acf226f35002f39f1596d3
- SSDEEP 3072:/WKjx2yp1tLqA1HB4kdeRqGmX5EMMi6leGS:3xBPVf1HB4kER4UFhS
- TLSH
  T18AC35C1BB3E540BBE1768138C8671A15D372B8214B61DBAF13A4465D1F237E0AD3EF62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  mpclient.dll
- Size 2.2MB
- SHA256 3a95e1c2c599e7c27537e42713451e862dcd318660bbc11bbb45f1432f68499c
- MD5 fcfda692c84f930191c2b8b1adbcddb9
- SHA1 cda8edd09090da67fc542a4f839135fc156363f0
- SHA512 1cfeed102d75e4c7849e3954e2f57cec3719c319149c134d4921dd8e3d4ffef782285bc1496ca0f6680c197881ef5737b0aee4e562aca7a78b65da7cb0b014e2
- SSDEEP 49152:WxurMreHHztGyjwxm/pzVuSI5wy+PYN633OlSR9mTeQi+O3d82AUsa:WAnj+0sa
- TLSH
  T1F0B58C0AACD008B6D46A53328CB752927B39F8180B7327D72E26A7782FF2BD05D75744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

ef045f18455132bc2e22c24a3c41c8a9 vidar stealer defense_evasion spyware trojan
- Detects Vidar Stealer
  stealer
- Family: Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral10 behavioral9