Extracted

• • Target
    _24b6d3a93b1e2f955a9e13523d4ad64203d32df3f6a92a3258f9a7fe63ebd30a.exe
  • Size 3.0MB
  • SHA256 24b6d3a93b1e2f955a9e13523d4ad64203d32df3f6a92a3258f9a7fe63ebd30a
  • MD5 22f31f770d7effcf359973d6ab4bcdee
  • SHA1 ed335e1f2dbc4271b314d0ecd38da27d0d690935
  • SHA512 b4778e7b2b95949eba3bd8c23030d9e456cda68a00e5dc2279b531ba80a79c87362fdb5be1079a003fa88ce296f824ea032b4ffef2b022cc64922e46dc5fc651
  • SSDEEP 49152:B8S14dN2hl6U2wZ53sakYmd09WkEOG9E1+VnRnt7L/ZWoGolbCkkCXc/PtMcVFl6:B8EsNu5OXyKH
  • TLSH
    T194E54946A86644FCC19CF53054F63D50AF2138486B3D27D31AA27AA86F37BE11E3572B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  3ca580e6c99aff4c35ecaba0d62c539ediscoveryexecutionremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2