{"id":1577,"date":"2024-06-12T07:18:09","date_gmt":"2024-06-12T07:18:09","guid":{"rendered":"https:\/\/threats.amnpardaz.com\/en\/?p=1577"},"modified":"2024-06-18T07:45:06","modified_gmt":"2024-06-18T07:45:06","slug":"spy-win32-geremas","status":"publish","type":"post","link":"https:\/\/threats.amnpardaz.com\/en\/2024\/06\/12\/spy-win32-geremas\/","title":{"rendered":"Spy.Win32.Geremas"},"content":{"rendered":"

Overview<\/h2>\n

Type:<\/strong> Spyware
\nDestruction Level:<\/strong> High
\nPrevalence:<\/strong> Low<\/p>\n

\nMalware Names<\/strong><\/h3>\n

\u2022 (Padvish) Spy.Win32.Geremas
\n\u2022 (Avira) TR\/Spy.Gen
\n\u2022 (Kaspersky) HEUR:Trojan-PSW.MSIL.Geremas.gen<\/p>\n

 <\/p>\n

What is Spyware?<\/strong><\/h3>\n

Spyware is a type of malware used for spying and stealing personal and organizational information. Once installed on a user’s device, spyware continuously threatens data security, potentially stealing and transmitting information to unauthorized parties. Typically, spyware is installed covertly and operates without the user’s knowledge, often masquerading as a legitimate application. This type of malware collects data on user activities, such as passwords, credit card details, keystrokes, call logs, contact lists, and text messages, then sends to external entities.<\/p>\n

 <\/p>\n

What is the Geremas malware?<\/strong><\/h3>\n

Geremas is a type of spyware designed to steal information from victims and send it to an email address. Targeted data includes information stored in the Chrome browser, system passwords, and details from the Telegram application.<\/p>\n

 <\/p>\n

\nTechnical Description<\/h2>\n

Indicators of Compromise<\/h3>\n

\u274c\u00a0Presence of a file with the .bat<\/span> extension, as well as SAMS<\/span> and SYSTEM<\/span> files in the C:\\ path<\/strong>
\n\u274c\u00a0Presence of a file named protects.zip<\/span> in the %AppData%<\/strong> path<\/p>\n

\nPerformance Description:
\nData Theft:
\nWhen executed, this malware creates a file named ree.bat in the C:\\File\\ree.bat path and runs it at regular intervals to steal stored passwords. It stores information in the HKLM\/SAM<\/span> and HKLM\/SYSTEM<\/span> registry keys, where the SAM key encrypts system passwords and the SYSTEM key contains decryption information.
\nThe ree.bat file code is shown in the image below:<\/p>\n

 <\/p>\n

\"\u06a9\u062f<\/p>\n

\nree.bat file code<\/p>\n

 <\/p>\n

Additional data collected by this malware includes:
\n\u2022 System user passwords, saved in the %AppData%\/protects.zip<\/em> file and sent to a malicious server
\n\u2022 Login information and cookies from Google Chrome<\/em>, extracted from:
\n\u00a0%AppData%\/Local\/Google\/Chrome\/User Data\/Default\/Network\/Cookies<\/span>
\n\u00a0%AppData%\/Local\/Google\/Chrome\/User Data\/Default\/Network\/Login Data<\/span>
\n\u00a0%AppData%\/Local\/Google\/Chrome\/User Data\/Default\/Network\/Local State<\/span>
\n\u2022 Telegram Desktop<\/em> information, collected from:
\n%AppData%\/Telegram Desktop\/tdata\/key_datas<\/span>
\n%AppData%\/Telegram Desktop\/tdata\/D877F783D5D3EF8C<\/span><\/p>\n

 <\/p>\n

 <\/p>\n

Sending Information to the Server<\/strong>
\nTo transmit stolen data, the malware logs into a gmail.com account with the following credentials and sends the information as an email attachment:
\n\u2022 Username: alqasabiibrahim2@gmail.com<\/em>
\n\u2022 Password: yknglwcjirbnbirb<\/em><\/p>\n

\"\u0627\u0631\u0633\u0627\u0644<\/p>\n

Sending emails containing stolen data<\/p>\n

To ensure persistence, the malware copies itself to the Windows startup<\/em> path, ensuring it runs automatically at every system startup:<\/p>\n

\"\u06a9\u067e\u06cc<\/p>\n

Copying the original file to the startup<\/em> path<\/p>\n

 <\/p>\n

How to Deal with and Clean the System<\/h2>\n

Padvish<\/span> <\/a>Antivirus can detect and remove this malware. To prevent infection:
\n\u2022 Keep your antivirus software up to date.
\n\u2022 Download files from reliable sources.
\n\u2022 Avoid clicking on suspicious links and scan email attachments with antivirus software.<\/p>\n","protected":false},"excerpt":{"rendered":"

Overview Type: Spyware Destruction Level: High Prevalence: Low Malware Names \u2022 (Padvish) Spy.Win32.Geremas \u2022 (Avira) TR\/Spy.Gen \u2022 (Kaspersky) HEUR:Trojan-PSW.MSIL.Geremas.gen   What is Spyware? Spyware is a type of malware used for spying and stealing personal and organizational information. Once installed on a user’s device, spyware continuously threatens data security, potentially stealing and transmitting information to…<\/p>\n","protected":false},"author":27,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[77,78],"class_list":["post-1577","post","type-post","status-publish","format-standard","hentry","category-spyware","tag-spy","tag-geremas"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1577","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=1577"}],"version-history":[{"count":1,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1577\/revisions"}],"predecessor-version":[{"id":1578,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1577\/revisions\/1578"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=1577"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=1577"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=1577"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}