Overview

overview

10

Static

static

3

CdiResourc...86.exe

windows10-2004-x64

4

CdiResourc...86.exe

windows11-ltsc_2024-x64

4

Setup.exe

windows10-2004-x64

10

Setup.exe

windows11-ltsc_2024-x64

10

data/install.dll

windows10-2004-x64

3

data/install.dll

windows11-ltsc_2024-x64

3

data/svml_dispmd.dll

windows10-2004-x64

1

data/svml_dispmd.dll

windows11-ltsc_2024-x64

1

icudtl.dll

windows10-2004-x64

1

icudtl.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    b5401fae79dd2fb71b4a325479da5523135c1a2fb70998a2bbc234c444576b97.zip
  • Size 249.4MB
  • Sample260916-1a2bwazz2k
  • SHA256 bde542c989a35fea46273233ade7ad52e5e5241165009505e56f95b72cc47b92
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
donutloaderremus_stealerdiscoveryloaderstealer

Malware Config

Extracted

Family

  • remus_stealer

C2

  • http://drepace.click:7289/images

  • http://arqtsop.shop:9932/invoices

  • http://trwehop.shop:5627/articles

Targets

    • Target
      CdiResource/vc_redist.x86.exe
    • Size 13.2MB
    • SHA256 5365a927487945ecb040e143ea770adbb296074ece4021b1d14213bde538c490
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral1behavioral2
    • Target
      Setup.exe
    • Size 880KB
    • SHA256 6d8357b262d4362af3a5b34cac05604bb6f0c9f524b87ea32de1c9aa00f1613b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoverydonutloaderremus_stealerloaderstealer

    • Detects DonutLoader

      loader

    • Family: DonutLoader

      DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

      loaderdonutloader

    • Family: Remus

      Remus is a stealer written in C++.

      stealerremus_stealer

    • Executes dropped EXE

    behavioral3behavioral4
    • Target
      data/install.dat
    • Size 158.3MB
    • SHA256 da3051dedd40907c10f7c5705d5deaca758b6a4f160602130293334f418d7d38
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      data/svml_dispmd.dll
    • Size 18.0MB
    • SHA256 ae919450562b7d7a01b09f8879d12197932e0c99901c67287e55202defd04deb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      icudtl.dll
    • Size 10.0MB
    • SHA256 9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9

MITRE ATT&CK Enterprise v16

Tasks