Hermes (Stealer) Propose Change

According to AngelaMos, Hermes is a commercial Windows malware platform sold through tiered subscriptions on Russian-language cybercrime forums, combining credential theft with interactive remote access and administered through a browser-based panel with worker accounts and a versioned module catalog. Its native x64 client collects browser credentials and files from Chromium- and Gecko-based browsers, application sessions such as Discord, Telegram and Steam, mail clients, cryptocurrency wallets and password managers, and transmits the results as serialized reports. Over a persistent WebSocket connection to its server, it also provides file transfer, command shell execution, clipboard access, input logging and both visible and hidden desktop control, with persistence through registry Run keys, scheduled tasks or WMI subscriptions. Further capabilities are delivered as separately versioned module DLLs sharing a common host interface, and the client has been distributed through trojanized GitHub repositories whose Python code loads it through a multi-stage loader chain.

References

There is no Yara-Signature yet.