Extracted

• • Target
    sunwukongs.exe
  • Size 3.0MB
  • SHA256 0ab83feefb3ea1ba67dd9834bb489ca3c9ad311a49f3afa1e1ba9b72de22ef76
  • MD5 b3a00a3f8432a34f459614aa5dce55ee
  • SHA1 43da4180926c5fdfcc598b5fab2aa29d1ab8a71e
  • SHA512 dcacef98ff334ec08b1c9014db3d85aea8cb37641d20dc14b856dd7dfcfc5f6b9c14321fcbcf52c761d44cdadca07207df979c2f77d5f86a6d29966c092c269e
  • SSDEEP 98304:vwgOv4UTgr0yKGviNz64TQIXQnMg1Faz01:YlvJTgrKGvi56QQnMg1FG01
  • TLSH
    T135E5331E919CEEE3E5C677F4F96ADC5361C134300BA944EA3278874EE874AF749B4680
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerstealerspywareexecution

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2behavioral3