Extracted

• • Target
    BoostrapplerNET/Bootsrappper.exe
  • Size 1.5MB
  • SHA256 cdd16fc0a2bf1499ba815bc95288456e46c7245b64c9d06033f2c61eb06900f5
  • MD5 b54877136bd689c817ddce19c6d51787
  • SHA1 85014d9372d9d70ccd1a57bc018b985564ac5e49
  • SHA512 6b3d6d29145de291303119c6b38b4438083c1e87b11315dc86bb2e62fb07fcea93e95a0e28dce652f76ff95ff68b5568be53082e82b93fcb5423fde7068f8107
  • SSDEEP 24576:Zg18kF36aZTWynBjQ6OgLP88WoSSQxf0QVD1m5:ZW8s3xZaEYgLPN8VD1i
  • TLSH
    T1577559477C9064BAD5FA923188B5A2D17A31F8490F3127C33B51B6BA2E773D44E39398
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  4ddc2f013cf6edc40365c02fba709980discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2
• • Target
    BoostrapplerNET/Workspace/373f5d42922fa6b5ac57adbb41b8015f-cache.lua
  • Size 327KB
  • SHA256 d10aa3cabff1a991014244e4349f77730bbf1c6e6ac16b0411dca5c4d4efa4ae
  • MD5 3cf835cb8c9c25b2debfd164f3b5acab
  • SHA1 973c8195b710079e72cf4f0c9e819f9434b85900
  • SHA512 0089a54f08fe6c211984610de8489c2a899b1f74ed806c25c69a80736fd14dfa617b47cd3ee954f9c27b9b70ce262c2e7729fec800d4b7546b4950df3a1ba0bf
  • SSDEEP 6144:IU0todyyPGaBeAUZIhrYckgZO1et/rrxpAzSefTE59JtzZNqy/:IUuo0y9TUGh8vQYO/rdiVe7p
  • TLSH
    T1EA649EE871CD23D4EB2079E14E2B189CB35304E9A4AB5A99444CB1763E81379CE7CB77
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral3behavioral4
• • Target
    BoostrapplerNET/runtimes/app.asar.unpacked/node_modules/btime/binding.node
  • Size 118KB
  • SHA256 98c51303c38dc03faeeba13f26fa3c6645d0c1a502b8a5d28177ce015dacf35f
  • MD5 13a2579ed95366185a6247c9e4b9f0cc
  • SHA1 61fef12da622484e44b3c9ddcd61706c9af00aa0
  • SHA512 7aae5a45f5333355c81e4a7468d40c9d814a1b242c99a39747fea9b66e277dd1060bda290fc980e958beccab2ac0232fc4aba078426ac5ae39c19968ae8f58d0
  • SSDEEP 1536:OMwHUFyUCyB7KdX2teZOpSPtvdO+tYLZI2mAq+J6sWyd09dlgh7tBrdO6t2:hwjUCyB7eC8OpSS+tYLZI5+NMKFdO6t
  • TLSH
    T1ECC36C57B2E541BFD4768278C9930A45D3B2B82507309BDF07A4425A1F237E1AE3EB72
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6
• • Target
    BoostrapplerNET/runtimes/app.asar.unpacked/node_modules/get-fonts/binding.node
  • Size 125KB
  • SHA256 149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c
  • MD5 eeb1d1ea9fc3f870f292161cfa79850d
  • SHA1 ea4f4324245f9f4d6280ef285151f688221d6023
  • SHA512 795269fba2737ca51d61bb0f6e674c8ed45f2590a48d1dbc53adae9a85b5565e372de6e2a888f038660173f6f4fe0ecda293c441415296e79097c261c452f254
  • SSDEEP 3072:cd5+N3E2MosoJCakr0dHPAMMMtrAfz9MrRAG:yIxMQQakr0xPSfzirqG
  • TLSH
    T1E4C35B1B73A440BBE4778179C8531A05E772B8610B71DBDF07A0429A1F637E1AE3EB61
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral7behavioral8
• • Target
    BoostrapplerNET/runtimes/app.asar.unpacked/node_modules/vibrancy-win/binding.node
  • Size 118KB
  • SHA256 094bfeb0692885f1e56bb363e1065099eab48a7988c8603fd6a3fb49ec88b09c
  • MD5 6c12c930f974e5bc7872b58964f42359
  • SHA1 805c5c899c32535d2ee8b2bc12deefe5fdaae566
  • SHA512 f46c416e3f33e0526c2d4cb3df738f7c9b11fece350b90ca9613e5d86bae7a363dd20b80d62f5745a9d51773b655199537b09fcf47acf226f35002f39f1596d3
  • SSDEEP 3072:/WKjx2yp1tLqA1HB4kdeRqGmX5EMMi6leGS:3xBPVf1HB4kER4UFhS
  • TLSH
    T18AC35C1BB3E540BBE1768138C8671A15D372B8214B61DBAF13A4465D1F237E0AD3EF62
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral10behavioral9