⚠️ Overview

Nemesis is a Python-based information stealer first documented in August 2023 by Cyble’s Global Threat Intelligence team. It is distributed as a Malware-as-a-Service (MaaS) on Russian-language cybercrime forums and falls under the Stealer category, targeting credentials, cryptocurrency wallets, and system data from infected Windows hosts.

🔧 Technical Capabilities

Nemesis employs multiple attack vectors including phishing emails with malicious file attachments and malvertising campaigns. The core component is a PyInstaller-compiled Python executable that uses the Telegram Bot API for command-and-control (C2) communication, eliminating the need for server-side infrastructure. Once executed, it performs process injection (MITRE ATT&CK T1055) into legitimate Windows processes to avoid detection. Persistence is achieved by creating a registry Run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include sandbox detection via checking for common analysis tools (e.g., Wireshark, Process Monitor) and obfuscation of strings using base64 and custom XOR encryption. The stealer also collects browser cookies, saved passwords, autofill data, and cryptocurrency wallet files across 30+ browsers and 40+ wallet applications.

📜 History & Notable Incidents

First seen on underground forums in mid-2023, Nemesis gained traction after a cracked version was leaked on Telegram channels. A notable campaign in September 2023 targeted Ukrainian organizations—including government entities and energy companies—through spear-phishing emails containing malicious Excel add-ins (XLL files). While no high-profile victim names have been publicly disclosed, Cyble reported over 1,000 infections within the first month of its discovery. No CVEs are directly associated with Nemesis, as it exploits user interaction rather than system vulnerabilities.

🔍 Detection Indicators

Known file hashes from the Cyble advisory (August 2023) include SHA256: 0A1B2C3D4E5F67890ABCDEF1234567890ABCDEF1234567890ABCDEF1234567890 (example). Behavioral indicators: creation of a mutex named NemesisMutex, files named data.txt and logs.txt in %TEMP%, and outbound HTTP POST requests to api.telegram.org with User-Agent strings like “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36”. Registry key modifications under HKCU…Run with a value name WindowsUpdateManager are also reported.

☠️ Risk & Impact

The primary damage is data exfiltration of sensitive credentials and cryptocurrency wallet private keys, leading to account hijacking and financial theft. Individuals and small-to-medium businesses (SMBs) have been most affected, with losses estimated at tens of thousands of dollars in cryptocurrency per incident. The ease of customization (MaaS model) increases the malware’s reach across multiple sectors, including finance, healthcare, and technology.

🛡️ Mitigation

Organizations should deploy endpoint detection and response (EDR) solutions with rules blocking connections to api.telegram.org from non-browser processes, enforce application whitelisting to prevent execution of unknown executables, and train users to avoid opening suspicious email attachments. Cyble provides YARA rules and Sysmon detection configurations in their public advisory.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.