remus_stealer | 71868921a8fb432c39fc5d90352426d8eeabf14b971adc723722c6bb210fa668

Sharing

Copy URL Twitter E-mail

General

Target
REPO-SteamRIP.com.rar
Size 596.5MB
Sample260811-1tzmdsseqf
SHA256 71868921a8fb432c39fc5d90352426d8eeabf14b971adc723722c6bb210fa668
MD5 3ec01f4880b192c4f79c9906454998c1
SHA1 f16aa5dbc2df12bc0e97ed2ffbb5a77b15cecf03
SHA512 af328a0b1dd91a9205be47d50abb48f74d85a7e2a653ba004d672d098340aea52d53244a0ca4ff120695006fcc114022f2660a1f2bd1bab4274550e0ea01e922
SSDEEP 12582912:xRD09Ow6wGsdF/fgdwDojzMV0aCcvwyEPe0+vy2mID5Uyp/y0IpSiTUsoBN7:mOw6wGigAG6VYyEPCxmIyA/BIpTU/
TLSH
T1495933EC34B936A1D55B223DAD6FD0283F4E66006DA0007E00E61FBC7ABC67547A6B5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  R.E.P.O/MonoBleedingEdge/etc/mono/4.5/DefaultWsdlHelpGenerator.aspx
- Size 59KB
- SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
- MD5 f7be9f1841ff92f9d4040aed832e0c79
- SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
- SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5
- SSDEEP 768:6CEPutHjvpMgMwP9h5Ij7khsp/6JtEZwMXVtkUI3t3CXyEyk3VbNbqDvJ4oT1y:/r6CdsCOZwMX3k5dWyklh+Dvbw
- TLSH
  T18C43C4A0EE5C8D36499B52D9F48140DCB9BCC43191299CF3FCDDA12AF09CC6DA278676
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  R.E.P.O/OnlineFix.url
- Size 46B
- SHA256 3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
- MD5 59bf167dc52a52f6e45f418f8c73ffa1
- SHA1 fa006950a6a971e89d4a1c23070d458a30463999
- SHA512 00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26
- MD5 SHA1 SHA512
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3 behavioral4
- Target
  R.E.P.O/OnlineFix64.dll
- Size 11.4MB
- SHA256 54a65b4e133c6a4ff7107b4b9c868e10c3ba606bb42d8c687054b0a64fafa944
- MD5 485fa45f1886c44a1f2dbf7b8c132971
- SHA1 3833e8c37c6181ff148e0ca19f28145f9b80a8a9
- SHA512 e1e77f0f710abfa92261305d893597093177250d57630ce459bd657c09fc05773b1fbbf0387c1ca854650e52a8071a0c152b9011cdb197d97149990943e75e5b
- SSDEEP 196608:NlMHThZSFtSb3v19yOO10Xx9OYRNJsV1aUIu:AHTTSFt8N/O+u
- TLSH
  T131C622ED55D062B4D1D38640B18B539931C1A14D81FD0D193ECB2D412FAACBF6A8EAFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  R.E.P.O/REPO.exe
- Size 651KB
- SHA256 412f7cf79cf16888999e22905ca3bb11a6074857efdf8c754073a47ef872317c
- MD5 68f1eb6a2f3a4b713f2dbdc3a856d69c
- SHA1 7189682835ad725453be3ee48904efed9403f291
- SHA512 e339fbf629091d306a7b707913fe472d01a0b4dba9585c8dd675c103d2a9e7ec1dc6555bf138f8b5bdfe2dcb3340d0d4d6d2ec1bde56775a13e502143a20ad36
- SSDEEP 6144:b/7Fu9mpcJ/OD8+l0+a4+w4e6mlasHq4Jn+3UDoRhog+Gj9b:b/7g4aOD8o0+a4JCmlasHj5mR9+ix
- TLSH
  T1E9E43191E6D9D0A0CDB187B5D7D1C6F8C2224EF9D9B4EA5B20E63CC33772A4389251E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  R.E.P.O/REPO_Data/Managed/Assembly-CSharp-firstpass.dll
- Size 295KB
- SHA256 2f2f5b1bb52df223f5b488633bf59525fcd513331a1e39aaa3321abf37c7a1b4
- MD5 a41503050b2b96e4e9bd4323bea05625
- SHA1 fa8df0d91a75ede2dd41a12db8492eb9d4359a2a
- SHA512 cc2a1d418094636efc9f8378889f825b0a5c9524dd9e62936624a02a6715ab1ba87d5e3b8dd7e481996becb8c2d4c060f6cc56dc877331fb51bad08c07c3d7de
- SSDEEP 6144:ID4ljWJOQNd/ir+5U/zW5mW9kkVn7kQCAWLKb8M:Q5Ndar+5GzW5mWL7kQCF
- TLSH
  T1A1543A7273F58104EBEF1F71A0B50A1943B5F95629B7F74C0BA430ED9A23B8496217A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  R.E.P.O/REPO_Data/Managed/Assembly-CSharp.dll
- Size 2.8MB
- SHA256 ce995a182ddc884ea965e87786f1986248d9616300fa825bcc04bca671ee6526
- MD5 8c1391b7ea8855e62322d9e836b78298
- SHA1 28b4d223e48fb9aeff01214ca5a6d71fa0c365df
- SHA512 d558e31c8a03eec25256ff57aa4957c5297adc293a823470fd920c2e0bd13b0455bc9c103c7bda817064c4d825bb19b9859ffc34184936750ced63d448f20f8f
- SSDEEP 49152:8rFyuHScsYpXGJvVzEMTY7qzjyxxSxwc0qGn6kXV4cmHDNMIdBv3MoeZv4NCtFe:8rFyuHScsYpXGJvVzEwY7q3ixSx3dG6M
- TLSH
  T1AED52966A3E90D37D82F03FFD1A51E12F3729846A262E7994E85B0FE2CC2F505805797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  R.E.P.O/REPO_Data/Managed/Autodesk.Fbx.dll
- Size 4KB
- SHA256 af72006294ecd57a4ff58c284bb6b1a77f329756c0a4646a89646a53577eca72
- MD5 a1c574f5549619ab5817e8989b7405b3
- SHA1 2014681dddde832f606889b28cbad2892fe4d998
- SHA512 2b6b79188560b512688c44de1067919069e7abf2f3ed1d0fa68a05db636fd9c195571adad1580f0043f6f3350c849377f5f450fc6c0a263635ae2edfaa30e9de
- TLSH
  T16F8151664BF84766E5B243B04EF3832262B0E810CE63C77F19841679AC222948E76F74
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  R.E.P.O/REPO_Data/Managed/Discord.Sdk.dll
- Size 157KB
- SHA256 a35fb47957520756ac2ba8333c9088a75f7e612cd3552b415f37b22718293875
- MD5 6a4fbdc840f96a10fcb3ae602e0ff60f
- SHA1 e5c88859c7f04923160a1659504444ea51fe7f1f
- SHA512 43d6ba019115f1d3969505caabeeb09924fe0e02d8f7e14b46530814ca57311ec499b6426f3e7c3693c44baa93b86dc34f590ef564850fa025cfac423639070b
- SSDEEP 1536:MOjmnx8RfJxY9GkBOUEJeIKfp3txBJhdJLqzca+KijNOezzx3pRWTcX2vZn3MiCx:5mx8NidOU+Qp9xxO3AFw3Miy
- TLSH
  T1C3F3D8461BD40EF3C599B239F4224503C3B6F19CA21B935BE66E727C7A13B1196C2D8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  R.E.P.O/REPO_Data/Managed/Domain_Reload.dll
- Size 4KB
- SHA256 67891415cedc143ed5751d530f5247aea89b151e65fd50087a066be514113835
- MD5 e024de7ec8074c8bb6b84b21c82edbf0
- SHA1 9e872ab6d5199982d95097b605bb4cb5890dcd5c
- SHA512 e5126a073ae492b7cbcb73f0617873e4cd3c5580ed961e5da6f643b3cda18cfb66ce82916216a9dde70d84aa67f591bfdcda90e5fe2531699f18142a74772baf
- SSDEEP 96:TiNfBK+28hWpIdhpL80kxkOXgHpq7p3hL:IJK7yWadD8JucT
- TLSH
  T1A891665B57E88367E8E647395FF387A727B0E4059A52876B98C40A55EC217800E32F74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  R.E.P.O/REPO_Data/Managed/Facepunch.Steamworks.Win64.dll
- Size 561KB
- SHA256 5455938d4c11f198103c6151897563707b0a27625be451d6accd12df6bc7db40
- MD5 dacfb79e89b1fb5dff1ad3049f78f8eb
- SHA1 a6ca9228b0dd8fc0f8dd8ddd43fa98153cdc7ae6
- SHA512 1d74f52ab334d3fd6182fef8ddb6ef844d146fe1adc96505d91ece6450b1b4573fbb6519457c0f4299b82d28faf4ae35f1c4afdc55b86c3320b8700902be2ef4
- SSDEEP 12288:UEU6k6nz3x18btUDoxkyxVQvVM1JWa8JCotVB+MUReTRx:UEbiNxVQoJWa8JCotVB+MaeT/
- TLSH
  T13FC45CB1A71C6A7AC69E4636C0524E0F56B0C00B5692EF9F2A88D17EEC923417D773C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  R.E.P.O/REPO_Data/Managed/FbxBuildTestAssets.dll
- Size 4KB
- SHA256 102879be1e46200aacc44d973fd997a5d7a1adfcaef4fffba0fe6c87446b9858
- MD5 d66f30207a8292df214906b69c6c61de
- SHA1 937133487c0779f63f5f867a0f1930b651fba008
- SHA512 f3716226f9f4dcb53d88a9fd78197c9d8055131ea79174eba030ea1a996976fc025532382cc7f645d99243980001fddca53c6e306098fd5fff5b97e45f86ecde
- SSDEEP 48:6O+l597exYV1t40A11KH2bHYZ+IM81qYJQlMtNp/UKhkxke6LrfOIitlully3xq:ovvVeo2bHFeI4NdU0kxkJX2IiGXi
- TLSH
  T1EB91C86757D80627F8BA07B19EF7436A27B4E4048E62C77E298406597C223100E32FF4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  R.E.P.O/REPO_Data/Managed/Klattersynth.dll
- Size 84KB
- SHA256 790ef9d885034936bc7a1ef2298f47faa10b51b5e3637eacca7c39425386a47b
- MD5 09b4f29cae5f08a0c8eba1ee96e17fff
- SHA1 a8065580be301bf497a139bf9783caff903e196c
- SHA512 6c56435c34be5bae444758a7463d4c57dab6ed1961ae6cd73da3477e09101898106606bee718670101f8ccaa596883e8ba340b0439ab4defea2d1d540bbd9d93
- SSDEEP 1536:P6SuniFrszCg3tGsPJsvKssp6a2+Pm+hH8IfHXwpMXwp1vKvvKAJCXHOHJCFwBfO:POidsGC0CsQG9AQrN+U
- TLSH
  T12B8368B9EB9AF426D69BAE3963DCF474A573583CD016D30C493A701C61583CEBB4068B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  R.E.P.O/REPO_Data/Managed/Mono.Security.dll
- Size 235KB
- SHA256 c45f64becc58163ecb9492f90275808f6044da952f67576bfe9f3e71fdb4d6ea
- MD5 1f1c51d6a311ecb363e7f94441266d61
- SHA1 e532d37475400906e25c5ae0c224734736bc0474
- SHA512 b72bf74fdc19bea003f8670d4513a9e3d2224dff7345b3e0b40095dc47e51fe30264da704ba43decbb154c8f07c79048145780ed4bc484bd6a5d59a1eb898fb1
- SSDEEP 6144:6UjTQ70cnf8MoVRxS9iJdBF119RJXG2yu+Q:7EiH119RJXV3
- TLSH
  T1E9344A1863F9531AF6EE8779D4B15019C3F4F50BB9AAEB4E5C8282AD1C027918C41BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  R.E.P.O/REPO_Data/Managed/Newtonsoft.Json.dll
- Size 675KB
- SHA256 a56146202232958f46bd6a28b5a7da166aea123ee0d646735a46e5c341dfbf1f
- MD5 d751086b7423fd5580b5e909b06217b9
- SHA1 c1707b17df636cd6d4a804361fc6ead4ef9db5cf
- SHA512 86655b59ad62664a35a30807cce7dc2c2be8f1ece235f35dc9031873d255dc6f13a22b55d0386becbe927f007a14a6d936ba3861d1103af8f2fe16aa0afebe11
- SSDEEP 12288:aBNYm5IWx4AhnIqjCfP4bYaRLL0eglBmjV+0kRqQCB0jEIF:aBum5I24A5LYa5g1ByNyq5B0jzF
- TLSH
  T119E4282063A89B26D1BF6735B4304D1547FAF807F2B5EB8FA604D5E92C977A08D107A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  R.E.P.O/REPO_Data/Managed/Photon3Unity3D.dll
- Size 235KB
- SHA256 291042cc5bdf7a31328b555f8219ac11cb4c3de9a2781d118e1c2de1e4cfb3b2
- MD5 bf03eb545611a208613612c96d8f0c25
- SHA1 57060077d334b54bbd064a5c6f7da7aa9d63d15b
- SHA512 aa8d490fd08f74106c5667cd567956256b9c324bdf787e13d332af123521fcdbf0c1e8b33b55a292f13bea83f8d0bb979148b1b719c973451d6d1daed9fe9d9a
- SSDEEP 3072:k0S8s2w+vy8sdfg7s4ZJFVdIMoXuaow6d3cuSkNE8bdz3fZhOUveM:kj8s2Rvy8s1qFTo+aV6dPdG
- TLSH
  T17A343A1C13F89A15EAFF1B7EC8B151425775BA13641BFB1E099068FA1CA27D2DC10BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  R.E.P.O/REPO_Data/Managed/PhotonChat.dll
- Size 34KB
- SHA256 1db75d90e70ba20cfc0d04ead07c5c139009da446e37cf9674b0b68ea0978dde
- MD5 9b9d759d4510584b46b36c154a054d27
- SHA1 40e6c8273a7aae254c81ba0105696834266304ff
- SHA512 5718af0284e8dbe8ddcb37e7a03b02a653565e98b12d24c56e1a67ea5155b751c4bafce08ed42a47354ce4bd9109443f8686e79f7303de7e309d9bde16712d34
- SSDEEP 768:hJhr6Q9dvc7eR4YZN6SjEFJVNOA7v7GZSoiyovbY:1bU7g4eDjCgSoiyos
- TLSH
  T1E3F2095287EC1A2AF6FF6BB2687012100BB6FD15BE31D35C5E8454AD1C62FD8C9213A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32