Overview

overview

10

Static

static

3

Bootsexecs64.exe

windows10-2004-x64

10

Bootsexecs64.exe

windows11-ltsc_2024-x64

10

locales/re...ng.dll

windows10-2004-x64

1

locales/re...ng.dll

windows11-ltsc_2024-x64

1

locales/re...ng.dll

windows10-2004-x64

1

locales/re...ng.dll

windows11-ltsc_2024-x64

1

locales/re...ng.dll

windows10-2004-x64

1

locales/re...ng.dll

windows11-ltsc_2024-x64

1

mpclient.dll

windows10-2004-x64

10

mpclient.dll

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    uploads_Bootsexecs64.zip
  • Size 5.9MB
  • Sample260815-b48wdaxtev
  • SHA256 e45148b8410214ee0b4ba344fab05a49186581ab7a540065fd6e4eebea75f729
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
remus_stealervidaref045f18455132bc2e22c24a3c41c8a9defense_evasiondiscoveryspywarestealertrojan

Malware Config

Extracted

Family

  • remus_stealer

C2

  • http://solirpa.click:9048/tags

  • http://mrlketo.shop:8932/messages

  • http://vexdico.shop:8539/products

Extracted

Family

  • vidar

Version

  • 1.1

Botnet

  • ef045f18455132bc2e22c24a3c41c8a9

C2

  • https://168.222.97.79

  • https://telegram.me/nwwfh8

  • https://steamcommunity.com/profiles/76561198719385745

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0

Targets

    • Target
      Bootsexecs64.exe
    • Size 878.3MB
    • SHA256 675322705c74329865f5d2ed18a70c1b523f7f684f6ae3dfec4b7940ef2b9b59
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryremus_stealerspywarestealer

    • Family: Remus

      Remus is a stealer written in C++.

      stealerremus_stealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2
    • Target
      locales/resources/app.asar.unpacked/node_modules/btime/binding.node
    • Size 118KB
    • SHA256 98c51303c38dc03faeeba13f26fa3c6645d0c1a502b8a5d28177ce015dacf35f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.node
    • Size 125KB
    • SHA256 149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.node
    • Size 118KB
    • SHA256 094bfeb0692885f1e56bb363e1065099eab48a7988c8603fd6a3fb49ec88b09c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      mpclient.dll
    • Size 2.2MB
    • SHA256 3a95e1c2c599e7c27537e42713451e862dcd318660bbc11bbb45f1432f68499c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    ef045f18455132bc2e22c24a3c41c8a9defense_evasionvidarspywarestealertrojan

    • Detects Vidar Stealer

      stealer

    • Family: Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    behavioral10behavioral9

MITRE ATT&CK Enterprise v16

Tasks