General
- Target Release_v4.7.zip
- Size 79.5MB
- Sample260901-2ghc1sydlf
- SHA256 ca40e8a6dc8bda961201dda3e5ede25a5d57a9d0a5a1c2ae3e3296c988d5d4cb
Malware Config
Extracted
-
remus_stealer
-
http://flreaow.click:6527/articles
-
http://cdire.shop:9048/users
-
http://shhsift.click:7647/invoices
Targets
-
- Target Release_v4.7.zip
- Size 79.5MB
- SHA256 ca40e8a6dc8bda961201dda3e5ede25a5d57a9d0a5a1c2ae3e3296c988d5d4cb
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Setup.exe
- Size 7.0MB
- SHA256 4fa3aabaa500102afdf5a4046df09eba6321339ef25e4f3f6c643d689f1f2fe3
Score10/10-
Family: Remus
Remus is a stealer written in C++.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bin/ahost.exe
- Size 49KB
- SHA256 f5bce745ed86d899da269be477ffd36d3f017a8fb43c82fc7e22cd227d76d586
Score1/10 -
- Target bin/brotli.exe
- Size 837KB
- SHA256 1ca51a30040b3bf71ff0cfa99532091a6cff5e1242bcd68353b5262000545597
Score1/10 -
- Target bin/git-lfs.exe
- Size 10.1MB
- SHA256 1ae193b7299c66b69a63cc4ba8d8dec11e549f1f2682217175302fc5dbcc5ad9
Score1/10 -
- Target bin/git-receive-pack.exe
- Size 3.6MB
- SHA256 d5f90ab53623307d3db6c294647bf106d9f5189432cec88fe73968be44a4c506
Score1/10 -
- Target bin/git-upload-archive.exe
- Size 3.6MB
- SHA256 d5f90ab53623307d3db6c294647bf106d9f5189432cec88fe73968be44a4c506
Score1/10 -
- Target bin/git-upload-pack.exe
- Size 3.6MB
- SHA256 d5f90ab53623307d3db6c294647bf106d9f5189432cec88fe73968be44a4c506
Score1/10 -
- Target bin/git.exe
- Size 3.6MB
- SHA256 d5f90ab53623307d3db6c294647bf106d9f5189432cec88fe73968be44a4c506
Score1/10 -
- Target bin/klist.exe
- Size 30KB
- SHA256 2fae26a74243aee9faa6566bf3be1fbea356329810e13a9e73cbae859827857f
Score1/10 -
- Target bin/pdftotext.exe
- Size 1.5MB
- SHA256 252d2b345662ba6d3705d79d53dad059aa8ef14f9dcf3afe015facbf1ca995e0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target sqlite3.dll
- Size 1.4MB
- SHA256 919572560c314e46b1dba56418bbb50e1620c0af328aec394eaff580c58f2fc5
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target x64/ACEEXCL.DLL
- Size 877KB
- SHA256 65077d9942193aa89e119b86ed6e26cbed159acb13faaae6e6503aea0564e780
Score1/10 -
- Target x64/ACETXT.DLL
- Size 290KB
- SHA256 ded28bef03257244fff18e03462733c1285ae2fd3e78bc9bb39cc06018c4f016
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target x64/AdobePIP.dll
- Size 477KB
- SHA256 0d0caaf6c9647a7962bb13d6fb4d06800722dfd52e3695895366b1917689c3e9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target x64/AdobeXMP.dll
- Size 957KB
- SHA256 f6e584a509a991c3eb11a8d49b705def6bd43761a4b603a2b3b3703fad179a30
Score1/10
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3