Threat video1:00
Remus Infostealer 1.3.9 Gmail Claims: Detection & IOCs
Remus 1.3.9's Gmail feature claims to outlast password changes; Hudson Rock calls it unverified. Get 9 detection rules, 27 IOCs and a free Splunk SPL rule.
Read the full threat intel for Remus Infostealer 1.3.9 Gmail Claims: Detection & IOCs →
Chapters
- 0:00The hookAbout $1,000 a month advertises Gmail access.
- 0:05The storyVersion 1.3.9 advertises a Mail action.
- 0:12Attack pathA 64-bit Windows stealer runs.
- 0:26AttributionNo threat actor is attributed.
- 0:30Indicators of compromise24 indicators to hunt: 7 IPs, 9 domains and 1 URL, and more.
- 0:38MITRE ATT&CK techniques20 ATT&CK techniques, from execution to command and control.
- 0:43Remediation5 steps now: Isolate the infected endpoint and preserve evidence before reuse.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About $1,000 a month advertises Gmail access.
0:05Version 1.3.9 advertises a Mail action.
0:09Its ad claims Gmail access.
0:13A 64-bit Windows stealer runs.
0:15Its server sits in a smart contract.
0:18Analysts say it recovers Chrome's master key.
0:20Its ad claims a Gmail inbox viewer.
0:26No threat actor is attributed. Confidence: low.
0:3124 indicators to hunt: 7 IPs, 9 domains and 1 URL, and more.
0:3820 ATT&CK techniques, from execution to command and control.
0:435 steps now: Isolate the infected endpoint and preserve evidence before reuse.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.