Extracted

• • Target
    Qoeu6zZ.exe
  • Size 8.6MB
  • SHA256 4eb3d3d1d7302ba01bdf1e7bd57ccb807d255aa9069e564a820e1950f6f01445
  • MD5 5ae6964f4e6da5c2d07fb1ee62a25da4
  • SHA1 80741a321e6e34eb56d2a09b04fd402981d95b48
  • SHA512 17fd8184add4ae53a5f4f6ced9e0f10de1d4998573863a9d1c648c084d87e9d5b2983c7cde746b0788d458f52dac0bf05a3b5b94dc29bfe147ccfc5767cfcdc4
  • SSDEEP 49152:yRJDBwIpZ42/D8lQU8PHdgidgCcRYIwiksiBwdGS:y/l7FD8lQZ2w1Vydb
  • TLSH
    T1C1963907AE6140F8D1EA6635C46B9653BF20B88C973433E32E90A9B52F323D07E79755
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealerexecutionpersistence

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2behavioral3