remus_stealer | 34a337eb0cac33f0a2a0f8f27a08013be502fe2231d038c4a951a0371921f106

Sharing

Copy URL Twitter E-mail

General

Target
Komplete-Start_3.5.6.zip
Size 109.3MB
Sample260815-3w194shr8v
SHA256 34a337eb0cac33f0a2a0f8f27a08013be502fe2231d038c4a951a0371921f106
MD5 d725ffaa0cc12779a405b11869544d6f
SHA1 210c59c501a36c6369fca7a5eae70a81152d5030
SHA512 90a3080a838d15497b45fe1fb95be6d84623177bec27b10df975f1df439588bb4719976ee5bc6644b1d5b5926b7e944c213bfe22b2737d03f7bb10657a47c85c
SSDEEP 3145728:kIw5r8EZVkJMc+imTUOpFx2H2V22X8uw4DH07w7Y98EnxLS+:NwLfiDOrGy22X8uJDZ7YBnB/
TLSH
T1D3483384880094E1F49DE237BE41BEA5ECEFBE1DD1B74A98597C719E52333A283F0525
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

remus_stealer

http://vexdico.shop:8539/users
http://mrlketo.shop:8932/comments
http://kupzovo.shop:7567/subscriptions

Targets

- Target
  FLTLIB.DLL
- Size 33.3MB
- SHA256 82b1a5ffdf569695f522537b98a78aa0dc655b7700efdbe80e1e664891cf709c
- MD5 987ea6e787945b049b32c1bdb31b54aa
- SHA1 da97a8cfeeecbc1af4d034bb877f9558840a4fe3
- SHA512 dde8c30a6f8c925142afae743ba10cb8e2639a46f405919565f0a8f30e1270d8e16f342f587301783b6b75fc0a04cf8dd17546b7ffbaa9682e47c3b7aa6d3bf7
- SSDEEP 196608:gBw90Fzm+TtnKz7Puu0cRzOeYT9UMeN/I5usq:gBw90FvTiT0S6eYTOMepxl
- TLSH
  T1D5778C05A39705ABD436DAF8CA3492F2F2B37D524636814B0959F63F1F73A504B3BA21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery remus_stealer spyware stealer
- Family: Remus
  Remus is a stealer written in C++.
  stealer remus_stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  Komplete-Start_3.5.6.exe
- Size 9.3MB
- SHA256 db119a9c1bf8c61269f6bcdf7cd329e86a45f7f0f9e0fe785fecda5f8af299be
- MD5 72f1276e747d79289e556f6a35b46ef9
- SHA1 78106197ec44e36a3b7355db8da3e1c6ad23e758
- SHA512 889f3e1c24c51734c99146f68aafa5d6966d87d527fcca10b4d92f68b4acb31ad76d3ad8e14b9121fee4da731d0f41a10d82818821a3f974a9127342b38c39f3
- SSDEEP 98304:WgZdPyFT7G9N9e9gu4teqPuY4RrGA0p/5chEuuZkJac:WgZdPC0LFUhbac
- TLSH
  T1ADA6D6B29C9689CCDA6CB7B18F1D0EEDDAA5AC166AD0452F82243C409E779C1CD3C35D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery remus_stealer spyware stealer
- Family: Remus
  Remus is a stealer written in C++.
  stealer remus_stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  MSIMG32.dll
- Size 32KB
- SHA256 6e04ca20b475d0424b8d8c8c84c8389315457e2ee2d3954f5e0ebd2018a4080c
- MD5 50d90d6930b84401479ea4fd98e0fa04
- SHA1 a98e47dbad479177df9297af6f73764a26d181ac
- SHA512 1df050dfa83adcb274651c2082e5369a6e9d18438347f35bafdcebddf9b1709f5a1961c32880dbf7e0210cc124de49e2dd8ba74746d555e37f8e2f6c215f0d99
- SSDEEP 96:KjnF+OSFpeDWdI3F0uYWk0kQlW1igk0t8cEpEZH3EW3JIWw:IFKpeDW+Fu0kziD0t8cEpEZUW3JIW
- TLSH
  T1E1E2CA16FB2E45E6F273833850732B167A79B6206B625BEF8550120E0C667D07978F6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  OLEACC.dll
- Size 480KB
- SHA256 40d73e20a9f008aa05ac0d57c31f8513d01f21b8070ac201124a8afa8f82586c
- MD5 7515532e5734298091a7d8831fb5bfcb
- SHA1 ac0e058aab48dc56ec5a570c1af8e3bd9f7649c8
- SHA512 d6af9b86ff0e1d8cc78ffe0df223a101aa1762de4914b03943992c163e3e76de2233e6bb84e6ab39ddf4122c4e17d6a7fc1ca873b28d42cd6008eca0717f859c
- SSDEEP 6144:Iyzofc8zZzmfADzi+LjmCUtxU0SuXigOCF+HPyP0jQssehKuVb:/zQDX/FuygOCF+vyP0hPV
- TLSH
  T1F4A4185E72A844EAC93AC17CC957420AD7B1B821175197CF1260E67DEF3FBE42A39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  SspiCli.dll
- Size 300KB
- SHA256 8b1134784d8babc6ef24569abba93e20917679c51cd777de972bdc6fee2fca22
- MD5 5368a0eda501b5bd821bb55664d04f6f
- SHA1 b43e4c935b2ecda48a88ff79868a41610f029cf4
- SHA512 df26d13641892e5ac17951fcca3c4b9a85dd3974622907e32a08c03251fbdf21fdfcdf16a4d6f0b012dc226791a50d8087b52bda9a284fe3a797bb6a11cb0c86
- SSDEEP 3072:uksV22GHg8RMkkKht2MST0SwDiANhsXmB/0WHZOVYOPaq0CQlmz3G7d:ukseHHRMkOMST0SwDiANmX+tZ/ZmY
- TLSH
  T1C564291EF6A548A9DC7AC23DC5478226A7F2B9601352C7CF06508639EE1B7DA2F35F40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  WINMM.dll
- Size 215KB
- SHA256 95f9d6069156740b12c125fb6f84e65de9a235b70c61369229f388c7cae8621c
- MD5 aba93c1d598db2eb33a58503aa356acf
- SHA1 c34d1f4daa75f8e522c62c6864d7ce3b502eb736
- SHA512 dbe424060de8dd04e78b568b3cd993d782d49b7349ac4746114e27bac210fbb26dbe17e45e9130cca333a864e9c88cc7a6818819e09525f8a3ecd7511f169dd6
- SSDEEP 3072:MKygNSd/Rd1gtxW/uTWC/Brx8AoanT6tnuY7BhT1hDzGR0ginHRRbyTZLhfZpk/:MJgURd1+W/jqnnT6tuYvH8inHuhL
- TLSH
  T1B5244A6D77EC10A6E97B9738C8A24A15F672F8341B1283DF02D0827D1E27FD8A934B55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  WTSAPI32.dll
- Size 174KB
- SHA256 19d35e25e3ce431b7ca6b25cb60f19dff9ffbede098bc7762baadf4f6220974b
- MD5 62a5d03fddd89c185393ce55152de8d8
- SHA1 3c663e4e766475097ad0f64f64ec72fb942695f3
- SHA512 08feed176fa20e0355c1e4b04c20aed75fb49372bbba2c3b1199406e016ad21c0a4bdcebfe116555acb11edfb9093c818ff958a9ae819b8b84ff1dff55185858
- SSDEEP 3072:18ldGBK2dtlY4uJ+XKUNZIlG4FWvhxDMeWmQBxkfbn+Ro1ql8OCq9s6dez7:1skBK2dPY4uJBUNG3+xo/cbn+Ro4rqwc
- TLSH
  T1BF044A6E36A900EAE57A9138C562861AFBB37031232117DF0290C17D5F17BE87D3DB96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  gdiplus.dll
- Size 1.8MB
- SHA256 33fff3fa7dc0032433ecc0611bdbf99b88b71a69113c9190834498a21a364a33
- MD5 444da63f336aa600bf2aeed2efcaa177
- SHA1 cdcbac0f68b4d01eaab64573ac151003e99ac904
- SHA512 cdc05908acb966ed2ea94877913bfa0a733011892c34ca345439217f9ccad986dd3302cd5efbd09423f0a5dced2f7a32d2bacbc0a9d1c07850b8d2b487843b02
- SSDEEP 24576:oE8mvwGLp+eUIdLLknvB7sBhKJmPXZn73bVHTsDOYytCaVnT:oZIwGLpJCp7s7ImBntT3Y2Zn
- TLSH
  T146959D59A6B811E9C67BE07CC147970FE771B825036152CB33A09ABD9F2BBE0167D321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  model.dll
- Size 12.1MB
- SHA256 00d0c3b159bca29a00f12284afdb81b3dbadf5caea2bd346725e98ed72f4be07
- MD5 af561b2cb1c96b7acdbfa7b4d99e4bbf
- SHA1 815baa80c4a1c4b0842e9e3d9d9b6ca0e7c3677c
- SHA512 f5fb2c497b9c15b5f13fcdf1e6092848c0dec585c22eaa9f8d5f381ad14987aabdb442ef5800c487fdd01003e7f9b4e19498a3c9f57e496d22b60cfe66c3fa91
- SSDEEP 49152:CoI/BwnP24GZvNApGB/P2z02XqbeOxvXbhh6gOBI8nQBEiPbT8vhnn0CH53z8mth:ospppppppppppppg9nK
- TLSH
  T1DBD67D06401594B4B17A1B441F70B77046306EFD269EAF93B1EFF2899B398CC58FB46A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  x86/config.json
- Size 3.8MB
- SHA256 78695d93aa5816a9286d98cd43fe3e91480f5e75c2f093cd0b9770063a0547fd
- MD5 ffa03d1ac6fe3edac1e3d832161b952b
- SHA1 dcf841ba1a9eaad351b0999dfb827cf68e65e945
- SHA512 80983b46723c16766bf68578c61a420ac76780164030fdb37db3c66b8b99ab69b0376f8d01134636a7a314f373d899bb385ae1b3cb069c9c7cbf3e1c4d90baf7
- SSDEEP 49152:NujhpVsu5uFj6n3LUI8JxYA+Wypu41rhWSsdIpJh1nuv6j0+43/pFjDAwBMWpBCt:IhHsQl4ZswrARgvhiWaOuBu0ijfs
- TLSH
  T1B5167C5B75A84196D076C038C957AB0BEBB1BC564730A7CB22A0372D1F737A06ABF311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  x86/core.dll
- Size 12.4MB
- SHA256 1164952add16666920be10f8a91364700ce965d237e85ca72fc63397b8e68de5
- MD5 71ec18ba5b3578bc2e88f64d60ca0797
- SHA1 23fc447c1f77a0167dccb5cbb5deec32014cac31
- SHA512 f9deea04df889fc493e5d12471451aa1590e15afb4019337fb1a296ca2286dd93f883b255ecf7e1bd84c35b887d425d837ef68ef9cce7ebe58df36ae77ac827a
- SSDEEP 98304:B8jd6lrLddIRBGprPmt/gP2XwIrlw168rk3PFHU:UiVd5PQ/gPawklw19k3Py
- TLSH
  T14ED69E86F0D665ADD617407421BFBB127D213E64425C0DF742E2E9B81FBA7403F2AE26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  x86/corel.dll
- Size 12.1MB
- SHA256 00d0c3b159bca29a00f12284afdb81b3dbadf5caea2bd346725e98ed72f4be07
- MD5 af561b2cb1c96b7acdbfa7b4d99e4bbf
- SHA1 815baa80c4a1c4b0842e9e3d9d9b6ca0e7c3677c
- SHA512 f5fb2c497b9c15b5f13fcdf1e6092848c0dec585c22eaa9f8d5f381ad14987aabdb442ef5800c487fdd01003e7f9b4e19498a3c9f57e496d22b60cfe66c3fa91
- SSDEEP 49152:CoI/BwnP24GZvNApGB/P2z02XqbeOxvXbhh6gOBI8nQBEiPbT8vhnn0CH53z8mth:ospppppppppppppg9nK
- TLSH
  T1DBD67D06401594B4B17A1B441F70B77046306EFD269EAF93B1EFF2899B398CC58FB46A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  x86/obsidian-source.dll
- Size 95.0MB
- SHA256 a29daf1b537ab3cc653b62849348b8459e328b874b947f2d1a87b7b33dca09ac
- MD5 203874655c31694988df5160c40787d1
- SHA1 bba49e2f4e2b541492ef2e31f825d162c3b356a9
- SHA512 9472e2f42e07a4099e649454428bd6cec7febd57c4d8800a2dbf0e2cc07b97f39a3bee23eb73f964fdc71b416dbed1e86791a25b20a83d1202d19565f43fa730
- SSDEEP 1572864:t9Q1VxiPhNrce8VtCqS5r3QQvzBycQJ6cSeuwafXmhy+cQC6lvRFBYvy6pq74xn2:t94YhZ8VMqSGytQIZNjYdKdM8xgRUitT
- TLSH
  T10D2833C54E4084E229A6741ABCC171F9FDEBFB1390B7ADC9482EB1AD433AA7241F4574
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Remus

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Family: Remus

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20