Extracted

• • Target
    Вооstаррег_х64/Sеt_Uр [UРD].exe
  • Size 1.6MB
  • SHA256 62fdad7df8fd7bc2b211c2de06c002831b36987b48a943758432f25006661578
  • MD5 d65fe05a3bee25edf755a4bdb8fe1a91
  • SHA1 db5aeb0d1554f53c2eab67243251383ccfdb7c6f
  • SHA512 7877cb43983be01732480da9796e13e6a48312602edef45b84c14ece777e64a7f08d97d6db036b6cb491212c3ae3a1164faa309da132b598b0a2cfde1d5ef525
  • SSDEEP 24576:ao8Yh5f/OwtXTGjlouCP5nFk5YlLw53AHcMmpIfm7gYzfrnerQw+:/5PD/uCP55L0AHcMmpIfif7YQw+
  • TLSH
    T107758D253785C136E1220272AA6DBB66D2EDBD306B75AAC7B3C81E0D1E715C35A30737
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  7b05988b8d8f8ae8b0104da34540b6c4discoveryremus_stealerpersistencestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    Вооstаррег_х64/libcurl.dll
  • Size 354KB
  • SHA256 94f503e2263bdd852a6a88ade9fb4b006312760d9a7bddb69f9b2692313082d5
  • MD5 ff51047587a4f042e074d61d7596d96e
  • SHA1 2e54ec7433bf47913212c55180cf9903ddbb9a9a
  • SHA512 60e1c7d56132b55ae434875893324f497cbf8c3b84244dec030e8b64ae0ce5e3aa31eb6c4d9255a21f8dda32c8b7b08129677fcafc334c9a5455f5f09fd506e4
  • SSDEEP 6144:0+bg9HDAY61iuGYCgdwFC91bEr7YkY4CzhEzX+K6sioo68MrjooMXJbWTpwT0H3b:0NHDgiunCgdwFC91bEr7YkY4CzhEzX+Y
  • TLSH
    T15574AE80AF80D0F2E1822278A527DB771D7DA115233BC5C3EBD45E646F34AE1A67938D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    Вооstаррег_х64/msbuilder64.dll
  • Size 1.1MB
  • SHA256 66cf8cfa2b92d04c5342f38ab366699d302ace0da7e2e6dd595648fb4084ea54
  • MD5 4f14234e4d44e7aea05ba04a6049fd48
  • SHA1 ed79c3722c35e43d83e91954e16f5adb5aee5c2c
  • SHA512 552e11e912e09f5020dd627ad7ecbb457e0f270c50028433fa93280e189614d7ef01c8c1fc4b912178651b8c8658b33363e21b825608a7d4ba6d87e64eca0dcc
  • SSDEEP 24576:+lxSqy4ggn5o6YtwWRz3ZKfPAYqRGlPsjr2pa5StbAIw8nFx+iKE:GSl4PnC643ZKfP4nr2I5qbAv8nL+E
  • TLSH
    T1B835330026BFC2583A5F61813A8FE776220BF1BF00607748FAE35CB77959B7214AA55D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    Вооstаррег_х64/zlibwapi.dll
  • Size 88KB
  • SHA256 f1a9c2ae8b8bd9778832998ec32c6a70cb6b2ba7ed7566ae6c83d7a63adc5954
  • MD5 24d5d1e6b84dabdfa691dc5b3f5fa66c
  • SHA1 afb52e07e3cae370b335d31ba511ef8b551eb69e
  • SHA512 0cc8367dc10105c5df11b75ae3f127fb2a5053e12932adfe30bf3677ad379c9e9bc606cb96a635d1881867e6ad0bff56d6749b5b14d5860d8a80d55f644cf594
  • SSDEEP 1536:U5/HXZ5gknG1z9TKaJXjN9IisKrRDxSKOzsWapcdy9chlWXRfRj:6/HXZbG1zVTXjvIexiy9AWXRfR
  • TLSH
    T150936B01B1E1C075D5BE19390834D6B24BBEB820DEA29DAB375617AE4F707C1DE24D2B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  7b05988b8d8f8ae8b0104da34540b6c4discoveryremus_stealerpersistencestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral7behavioral8