General
- Target hjbk.exe
- Size 219KB
- Sample260818-mdgvrazgre
- SHA256 de045904e83594cd3146d97da1e18da581bc4213eab7b7edcd81e8aaeb82b223
- MD5 012baf40aa73fd4f45ce46e62e8097fb
- SHA1 b07a60a0250267126315f44e528517226a6f2d02
- SHA512 b6e6e3e13d1b355c204f462f4e75c08cfaea441b45611d3c857fb53ec635771fdcbf2a18054e9ffe3c0cb9c6c38404135ffaca0744f932ee32b35117c15c4d9d
- SSDEEP 3072:Cbn53bMzNxgKH2RjpTwUngPAfhEXPIN19ff9XseiXt9H+iJhwlVQz+1JJIJj:U5MwF4gNb9XseiF4lVQz+1JJIJj
- TLSH T1B7244A67D35371FCD652C07892A67222B731B9390720DEFB43A3C735AE22AC06E79525
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
hjbk.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
hjbk.exe
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
Malware Config
Extracted
Family
-
remus_stealer
C2
-
http://fasnzect.click:4929/exports
-
http://vexdico.shop:8539/projects
-
http://kupzovo.shop:7567/collections
Targets
-
- Target hjbk.exe
- Size 219KB
- SHA256 de045904e83594cd3146d97da1e18da581bc4213eab7b7edcd81e8aaeb82b223
- MD5 012baf40aa73fd4f45ce46e62e8097fb
- SHA1 b07a60a0250267126315f44e528517226a6f2d02
- SHA512 b6e6e3e13d1b355c204f462f4e75c08cfaea441b45611d3c857fb53ec635771fdcbf2a18054e9ffe3c0cb9c6c38404135ffaca0744f932ee32b35117c15c4d9d
- SSDEEP 3072:Cbn53bMzNxgKH2RjpTwUngPAfhEXPIN19ff9XseiXt9H+iJhwlVQz+1JJIJj:U5MwF4gNb9XseiF4lVQz+1JJIJj
- TLSH T1B7244A67D35371FCD652C07892A67222B731B9390720DEFB43A3C735AE22AC06E79525
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Accesses cryptocurrency files/wallets, possible credential harvesting