Extracted

• • Target
    RoleX-BootV2.exe
  • Size 683KB
  • SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
  • MD5 6669e10c960f6c2297bcd3d5a27412aa
  • SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
  • SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
  • SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
  • TLSH
    T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  4ff560b9444ed1fb5bd566dbfbaec692discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware
  behavioral1
• • Target
    local_bin/EqualizerAPO.dll
  • Size 599KB
  • SHA256 2cb094f9a14dad89d9acf29fae4b6e036d8896b7e8eac52d010248a31006fb1d
  • MD5 3f96577baa37bf625bb350776a91296b
  • SHA1 cb9150ed61774b428ee3c55b7ab61be62baa8e8a
  • SHA512 62fe6ead155c9a176fe90bc2bbb848e9afa7d760add8b2d5e5ea1522997cc05c83d138ed1281d4c047599363f1658117070b85e425b4f3df3afee86bcd1a8e6d
  • SSDEEP 12288:3ruD49udWGn9SNMbrS456F+upz31+s5TiaN0a:3ruD4sdzt3p3o71LTiaNR
  • TLSH
    T12BD41906A2A903A8D0BBD27C8AA79912F7B678050775D6CF1391426B1F23BD1DF3E711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  behavioral2behavioral3
• • Target
    local_bin/Qt5Core.dll
  • Size 5.7MB
  • SHA256 872a148e5fecf7df77231f68ad10d739cfc7c06cc2c04666b641529750dde991
  • MD5 2f187bf96f7900698d8be13f55b295c9
  • SHA1 8fda0e7b9e9d5eff146477f47c7e0fcc9c18d24e
  • SHA512 f78d34aa2ee638025b7dd9fb14cb6f275bbeb9225915954b0c0d50dd7c59dd19841fffabd3de879c4b8e5b6ef4892a25a9558773e4b98b73d52af2d43ccfce38
  • SSDEEP 98304:Fh2mYpTb+mDZZKQkJsv6tWKFdu9C2idxqf/gw:z2mYpTb+mDbhkJsv6tWKFdu9C2Mxqf/F
  • TLSH
    T13F569D57B6A70150D0B6C23CC9A7821BE6B3B81287228ADF425CA70A5F777F1293F715
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral4behavioral5
• • Target
    local_bin/libfftw3f-3.dll
  • Size 2.6MB
  • SHA256 42ca18fff35dd12890e04478bc990005b3969cb744f6843976bd436ccd7f0a4c
  • MD5 9bc1a19ef7fafb31b43a964895ed9dcb
  • SHA1 4e9eccb805eb876177a6b3a42f912ac52e9f20d2
  • SHA512 72c5bc879c8869f0d3c00dc32f9187b267969948e5b578ac1a86af8c83d7126297eb9a7958d6da156a5f348aaca60bee0822c5416c17240cc8850dc2cadc2d8e
  • SSDEEP 49152:ZbVolI4xMje7CLVUnHQl1Wv+sKwh14RT9Z04TMzYr1ZBXwD2idL:3o+0ae7GQ+5XZidL
  • TLSH
    T11AD54A41B6ECCCDAF43E683091FAFA2B77257941490A479753A095AC1F637C02FE5A0B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral6behavioral7
• • Target
    local_bin/libsndfile-1.dll
  • Size 1.7MB
  • SHA256 740dc79589813c83f5a6b8ea214b5c1031041881b4dc96703e295a7c04d09f5b
  • MD5 ab078f3f6241fddfd39637d7b9358834
  • SHA1 c895b2555e99a34bed57ecaa328c56bda4481b3b
  • SHA512 f5646ce0255ae551308c6861447c39deade07f775ff33526bdc58e22a90132cae86ac44767b2b83c07633f54f8b516e06e2efdce75de98d9a0fa530d6e581d78
  • SSDEEP 49152:gmYf13JE1o6kK5eQnahfzNqTBboLTfKIK15sRcRcQQQkixzjYz:gNJELapfJq6b
  • TLSH
    T185851827D653AC6FC3F681704642EA727830FC6DD3726ABB298066B13F529305F5AB50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral8behavioral9
• • Target
    local_bin/msvcp140.dll
  • Size 552KB
  • SHA256 256492fbbcf3dc63987318f83e5f49eaacdbb6a9a5be54e403f0ddb437582881
  • MD5 111e00ce3412a863ddf3db65f237d62b
  • SHA1 58503f051d650d0d95ea36515682afce18f504af
  • SHA512 d586b8c2ee928aeed5e1e9f771dea24d209e09a47c8e84821ad0a5976e5fa16b77a04294100555f553aea85c5acdcfe49ad3aff6f645b5618fa8f482fcdb959b
  • SSDEEP 12288:F/Wn7JnU0QUgqtLe1fqSKnqEXG6IOaaal7wC/QaDWxncycIW6zNyVQEKZm+jWodm:ZN59IW6zN+QEKZm+jWodEEY
  • TLSH
    T1A3C40923B75D05E0E195A3B8A1838305D7F17C4A8312A3C792FB96AD2F673D56B3B190
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral11
• • Target
    local_bin/msvcp140_1.dll
  • Size 23KB
  • SHA256 2c03cf78553689ca0523a3ef7c3161939b8f4a2fe246d9e90efa9cfef95c59a7
  • MD5 6d0a35401a239a046dc2a43777b01a30
  • SHA1 0d7070f9abaa911f636cad4f0d5bf8a3445a9e6e
  • SHA512 9554ffb6d87aa25bc80bc56ddc46a5f310fe0cdbd4dd1ba412c58c4f103be55bd96dc76652c39865f662118df5853fc3d2886a7c02b4e156eb31d5abd7f1cc59
  • SSDEEP 384:IXt9apR9zFzN2WWcZ5gWc/14gHRN7eDH24rlGs8:IXK79zFzEqQeT6
  • TLSH
    T1F2B24B86FB284843F866543082A6DE07BA3DB3D59B2193DF1361E75D0DE37C1AA35A18
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral12behavioral13
• • Target
    local_bin/temp/d3dcompiler_47.dll
  • Size 3.3MB
  • SHA256 efbdbbcd0d954f8fdc53467de5d89ad525e4e4a9cfff8a15d07c6fdb350c407f
  • MD5 c5b362bce86bb0ad3149c4540201331d
  • SHA1 91bc4989345a4e26f06c0c781a21a27d4ee9bacd
  • SHA512 82fa22f6509334a6a481b0731de1898aa70d2cf3a35f81c4a91fffe0f4c4dd727c8d6a238c778adc7678dfcf1bc81011a9eff2dee912e6b14f93ca3600d62ddd
  • SSDEEP 49152:PyZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQ6:E9fWAwVBC8MH2JNSF8+YPsXqUT6
  • TLSH
    T1DFF59F21F701C077C8CA01F0666E7BA6257C9B75033945C762947DA9EC702E32F3AA6B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral14behavioral15
• • Target
    local_bin/temp/libGLESv2.dll
  • Size 7.6MB
  • SHA256 68d56f1681840e5f87e1b06c47a82887d9a147dcfc8de9c1f9a778f3370014de
  • MD5 a536c452920e0d95c5cd8cd187ca3e65
  • SHA1 c33974d8def318317615f9714ee175e0dbd80661
  • SHA512 959c81d2ce72b498aecc96f07666461c6b59f4e0c6113b5118b5e1cd727e8e9370a29a07595516066b83b70c43e4d1ac62b87545ec708019aceee3b7e3657258
  • SSDEEP 98304:5nlbXzhGP2sAjc8pjCT1VNpv0RCw+MGIuRStSVoYewueeNygIc73ECclRI:5nlLzhGP2sg75CpVNpv0RCAuRStSVEz
  • TLSH
    T160860B46EE474CF2DCD33775B197B32E9A25AC30892BC6E7DE458224D9A31C12C26B53
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral16behavioral17
• • Target
    mpclient.dll
  • Size 2.0MB
  • SHA256 02438f33455185f52cdd798336d9fd91836a29bf364bb9e419f72b2c5b1ed471
  • MD5 9c67c544665b837688911c7216662f38
  • SHA1 2785d8db7e30ddd0728d8da8606399188dcbaae5
  • SHA512 9c5fab96db8db93e9a8725e870bd053968bfc49635dc4fccd51049fa71814aa6b251a3a8646652c5c0073eca88fb874a1a1ba8ae6b51c73f16a317904670c4c7
  • SSDEEP 24576:6620bdddIvWAWVAPzDcN4tRjMCBtU/NBele5yK26Mj6H2ABaTVO:66Hh7IuJAPsNApMa4q3VO
  • TLSH
    T1CA955C466DD008BAC4AA53328CBA1292773DF8490B3327D72E61B27E2FB77D09975744
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  4ff560b9444ed1fb5bd566dbfbaec692discoveryremus_stealerstealerspyware

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral18behavioral19
• • Target
    presets/DDSPreview.py
  • Size 17KB
  • SHA256 a5fc7f2959b2ec55ded0ab8164c2fd16531dbdc394c33c0adb0a4b7de169e253
  • MD5 7443cbda06135e84f3d6045c7333b8c7
  • SHA1 f20e1c8fa3ddb7d34a199a6a079a7760f605ef6f
  • SHA512 ad06d00f6574f5e6538aea0a7c295920f679ce3cf69241b6ce6266c6c6090eb70ccb0057fe934bec541bad1c6c7a0f7e7fcad3bafd67d73655e61f048528f588
  • SSDEEP 192:306/66i86vi6Ph6k20f7CA0pQMSYautfwS7P7k8dK1mU3wvpmSxVAgL:30PDRgP7k4QwvpmCVp
  • TLSH
    T10A7277D2DA4A8114A533E86F15812D03EB2E9397981DD59F387C6054DFB4480C2F9FEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10
  behavioral20behavioral21
• • Target
    presets/FNISPatches.py
  • Size 9KB
  • SHA256 393feaa7b7927b66f3ede107a77d8b2e6dae9d4723cad9565651e64ec1a9a12b
  • MD5 02aa10fba48dd5e388de1d182d82e2b6
  • SHA1 e0053ba2cbb6e25806e4d13f62312eb20ce18140
  • SHA512 0c2d491789878a0d559b0094b1938cf2376b04d81ad95f83fce0bc55ffc78c01c0644ac5c8fa66f6708eb46855f93a2259218fee73cc7c8ad5639babb903cc10
  • SSDEEP 192:MBqMjctPihOPhX2yXyjU7d50QEOadkut/zkrJVKhpo//nsjgPRFuo:cqKUi8PhX2yXyjUgJdkukd08tB
  • TLSH
    T1EC2275F12DCFAA11E2B3835D992EDCD3F31B816B11286512797C82543FB1494C2B6EE8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10
  behavioral22behavioral23
• • Target
    presets/FNISTool.py
  • Size 19KB
  • SHA256 9cdf21f7e797cc0312fecc385790ca3a67555d0af57406d696251e09fc37a042
  • MD5 0b0f700ca8287585c28c61977b25053f
  • SHA1 a1e6a94311f217d0376a8620837c75f0d5c209a1
  • SHA512 3623307587c1c3b4a24cb564743fdd2eb363a921d6c82a9cadaf2647ec9b1d308463353a362fb99355b020ceb6ab02d03b0b9c6cf757c4df09c16a6e7d4b7125
  • SSDEEP 192:M7jbnrMCKJ0PoRnQ42k57jUg/y95pnbaV/g/FlpbNHy/8l8jHPzy/T8UfFcSt/DQ:W3MDJ0PoRnQ42k57jUD9znWy8ws
  • TLSH
    T12C92869DAD9D6A21D233432A193975CBF72782CF001C0E2A743C4BA16F7845583DEEE9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10
  behavioral24behavioral25
• • Target
    presets/FNISToolReset.py
  • Size 2KB
  • SHA256 69c3eea951ae26dddad43c110a0814a427679822b5bbb0b7f9249c903422cf75
  • MD5 929641a65d9317b0a21471ce02802bc9
  • SHA1 2a5c81100a0bfc01a51760f170a88f450cc6ad37
  • SHA512 4b4457ab5cf8b903a21c8764af41ad4d580a6bd815deddc90c99ff81912c3645e49e3ebac3e2fdf98ede96b52fd7a08d60dd405f8dbd94a03afa47df05cde9ed
  • TLSH
    T15241FFD1AD4BDA54923BC26D2D51D983F33E52031D1DA217B8BC81B06F385A4C1F9ADC
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10
  behavioral26behavioral27
• • Target
    presets/Form43Checker.py
  • Size 3KB
  • SHA256 32688f5ca3bc6eba94163c0479dce9622b07907d5aa5b405e9f3b1968940dac8
  • MD5 cad8a25b2c6169b6a0f407f55885ce79
  • SHA1 cf16a384dc9bc8943045b8935bb6a13958b7c3b9
  • SHA512 97fcf215c1b65bea29bf1e6cb52206c93b35dadc340434f62b295f786f7839e7503d422b94b3d34f9d8fca73d8f5da3325301e61d392359cd759019e4016b5fb
  • TLSH
    T147810FE2EE4FE805A2B2835D8919D8D7E75DC79B051C9203B57C90A02F36866C1F6ACC
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10
  behavioral28behavioral29
• • Target
    presets/check_fnis.dll
  • Size 50KB
  • SHA256 4c20fd64783299a172a902d6ed363ef95eb8e81fa7e8c56f114e090e712d6de4
  • MD5 6b1118334b92edb81c42680660e74bab
  • SHA1 1e07b57e8f6ef2f276786795dc317b07957366f7
  • SHA512 18cc6a6f0ff4b1d811c46df5652f2879ee1c95d00663673b5dd902c52a7c53d26ac0ffabca2a1bed2bf93d14b6c6f5538a172917138ddc538c21834d0be77bad
  • SSDEEP 768:f1DbtJWRyg6pG/JJFpx60yWTbohR7Beu+/:pWAg6pG/9px60JbSR7Eu+/
  • TLSH
    T1FD333A2E735801E5E178C2BDCB5B4A56E272F4204362CBFF4355472A2F277C6AA7E604
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral30behavioral31
• • Target
    presets/diagnose_basic.dll
  • Size 131KB
  • SHA256 03b0f12b25450d4cf51fbecb2177ce67b16ba63a2d3e1221d5cbd770bd554178
  • MD5 a2ebbf85b1043919bd9fa7e514b0c65f
  • SHA1 c9e761e7e9525ef1a071a7cd3ecdbe8885d699e4
  • SHA512 ab2f604915a16768bf6422e1a130b97a77da88a26a537afb9ebf76d6ddd887f44df9f577061485f54248a038f642575661c3cae5d4d846ce2936322717f49e91
  • SSDEEP 3072:Q1KfXscoAf0TvKQ9qCKarMczQNLd9jKk/:Q1Kf8cBf0WWkhczQNLd9jKk/
  • TLSH
    T137D35A2F366602F3E526D17DCB4B4946C3B2B01547129BEF036A072A2E377D06E7E690
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral32