Extracted

• • Target
    BootstrapperNET/Bootsrappper.exe
  • Size 683KB
  • SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
  • MD5 6669e10c960f6c2297bcd3d5a27412aa
  • SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
  • SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
  • SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
  • TLSH
    T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware
  behavioral1
• • Target
    BootstrapperNET/Workspace/373f5d42922fa6b5ac57adbb41b8015f-cache.lua
  • Size 327KB
  • SHA256 d10aa3cabff1a991014244e4349f77730bbf1c6e6ac16b0411dca5c4d4efa4ae
  • MD5 3cf835cb8c9c25b2debfd164f3b5acab
  • SHA1 973c8195b710079e72cf4f0c9e819f9434b85900
  • SHA512 0089a54f08fe6c211984610de8489c2a899b1f74ed806c25c69a80736fd14dfa617b47cd3ee954f9c27b9b70ce262c2e7729fec800d4b7546b4950df3a1ba0bf
  • SSDEEP 6144:IU0todyyPGaBeAUZIhrYckgZO1et/rrxpAzSefTE59JtzZNqy/:IUuo0y9TUGh8vQYO/rdiVe7p
  • TLSH
    T1EA649EE871CD23D4EB2079E14E2B189CB35304E9A4AB5A99444CB1763E81379CE7CB77
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral2behavioral3
• • Target
    BootstrapperNET/mpclient.dll
  • Size 2.6MB
  • SHA256 c20dc658f8aa9b49e8f2bbf46880f8d6598723020d21e97e8bb5468660eaa698
  • MD5 e463a3559c5c1c4cb67dea6737a0ab3f
  • SHA1 f7042f2f81aad68430cc2eead7adf2c0d7fad16e
  • SHA512 89667e30414f1166d0a646f08ac3a0b6651e5661fca5acb32ef1dbc2f26a7cc2789819cbff65436beb6cd9f5852f911932c976ed98f11f08175b18e20e689ce8
  • SSDEEP 24576:TITTJx6KSAYMxWG73R+8DJRGQLkiNpXGZFDm2Cqa3PMQy0cq/nBele7tKDQ5IF2Q:kTVxUA/D7hVDzG2kZm2OID4v+uRkzF
  • TLSH
    T1B1D54A06BCD048ADC099733188F626567B3DBC480B2263C72FA17A7A2E73BD16C76755
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral4behavioral5
• • Target
    BootstrapperNET/runtimes/app.asar.unpacked/node_modules/btime/binding.node
  • Size 118KB
  • SHA256 98c51303c38dc03faeeba13f26fa3c6645d0c1a502b8a5d28177ce015dacf35f
  • MD5 13a2579ed95366185a6247c9e4b9f0cc
  • SHA1 61fef12da622484e44b3c9ddcd61706c9af00aa0
  • SHA512 7aae5a45f5333355c81e4a7468d40c9d814a1b242c99a39747fea9b66e277dd1060bda290fc980e958beccab2ac0232fc4aba078426ac5ae39c19968ae8f58d0
  • SSDEEP 1536:OMwHUFyUCyB7KdX2teZOpSPtvdO+tYLZI2mAq+J6sWyd09dlgh7tBrdO6t2:hwjUCyB7eC8OpSS+tYLZI5+NMKFdO6t
  • TLSH
    T1ECC36C57B2E541BFD4768278C9930A45D3B2B82507309BDF07A4425A1F237E1AE3EB72
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral6behavioral7
• • Target
    BootstrapperNET/runtimes/app.asar.unpacked/node_modules/get-fonts/binding.node
  • Size 125KB
  • SHA256 149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c
  • MD5 eeb1d1ea9fc3f870f292161cfa79850d
  • SHA1 ea4f4324245f9f4d6280ef285151f688221d6023
  • SHA512 795269fba2737ca51d61bb0f6e674c8ed45f2590a48d1dbc53adae9a85b5565e372de6e2a888f038660173f6f4fe0ecda293c441415296e79097c261c452f254
  • SSDEEP 3072:cd5+N3E2MosoJCakr0dHPAMMMtrAfz9MrRAG:yIxMQQakr0xPSfzirqG
  • TLSH
    T1E4C35B1B73A440BBE4778179C8531A05E772B8610B71DBDF07A0429A1F637E1AE3EB61
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral8behavioral9
• • Target
    BootstrapperNET/runtimes/app.asar.unpacked/node_modules/vibrancy-win/binding.node
  • Size 118KB
  • SHA256 094bfeb0692885f1e56bb363e1065099eab48a7988c8603fd6a3fb49ec88b09c
  • MD5 6c12c930f974e5bc7872b58964f42359
  • SHA1 805c5c899c32535d2ee8b2bc12deefe5fdaae566
  • SHA512 f46c416e3f33e0526c2d4cb3df738f7c9b11fece350b90ca9613e5d86bae7a363dd20b80d62f5745a9d51773b655199537b09fcf47acf226f35002f39f1596d3
  • SSDEEP 3072:/WKjx2yp1tLqA1HB4kdeRqGmX5EMMi6leGS:3xBPVf1HB4kER4UFhS
  • TLSH
    T18AC35C1BB3E540BBE1768138C8671A15D372B8214B61DBAF13A4465D1F237E0AD3EF62
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral10behavioral11