hermes_stealer | 0569b13163463e4fee59dfee299cd1311bcf2658f9e099d6e8c6bc42d8b21724

General

Target
2026-09-04_a61f312baa3842158f14730990e38f87_icedid_luca-stealer_njrat_stealc
Size 1.7MB
Sample260905-bk994a1ves
SHA256 0569b13163463e4fee59dfee299cd1311bcf2658f9e099d6e8c6bc42d8b21724
MD5 a61f312baa3842158f14730990e38f87
SHA1 6fea675c67b4242fa2e1cd31623fc1596e2b649e
SHA512 3578d66b85506f990daeab6c92e752e3c78db943990d6a87e52304a21241b47b1a8b13dd53a869678e7f1c8d439ba850423791b40d1ffbc9d84c9b0caa734f7a
SSDEEP 24576:N1/aLY2i9HAHOzPhYynW8/1/dkewqy3tF8bG4jmveLpP3vhH:/CLY2jI5WIkp3vA/J
TLSH
T168858E1BA3A800EDD0A7C179CE175A07E7B2740513719BEB16D086E66F23EF15A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-04_a61f312baa3842158f14730990e38f87_icedid_luca-stealer_njrat_stealc
- Size 1.7MB
- SHA256 0569b13163463e4fee59dfee299cd1311bcf2658f9e099d6e8c6bc42d8b21724
- MD5 a61f312baa3842158f14730990e38f87
- SHA1 6fea675c67b4242fa2e1cd31623fc1596e2b649e
- SHA512 3578d66b85506f990daeab6c92e752e3c78db943990d6a87e52304a21241b47b1a8b13dd53a869678e7f1c8d439ba850423791b40d1ffbc9d84c9b0caa734f7a
- SSDEEP 24576:N1/aLY2i9HAHOzPhYynW8/1/dkewqy3tF8bG4jmveLpP3vhH:/CLY2jI5WIkp3vA/J
- TLSH
  T168858E1BA3A800EDD0A7C179CE175A07E7B2740513719BEB16D086E66F23EF15A7E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution hermes_stealer persistence privilege_escalation ransomware spyware stealer
- Detects HermesStealer
- Family: HermesStealer
  HermesStealer is a Windows stealer written in C.
  stealer hermes_stealer
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2