Extracted

Extracted

• • Target
    sample
  • Size 2KB
  • SHA256 b8d13de7a5a240c550f1baf560b0779a8e45e60f06bd73fde61688120484f7aa
  • MD5 c152de54a333ad894d8a39649085b53a
  • SHA1 754f4f88ba4518c36ebe769f17c21b6c88146bb4
  • SHA512 c2a36056e2bd3705b5cd80b88e9c5cce6a0881f58329c590ea9b5e59d1105d6fabfacc8cc8244e9d3454a30de05e33e7ca082e568688101c1297fa07b57c86f7
  • TLSH
    T1535166FB20F27005EF17A3000FA67A086293600715AEC8B6F3EC1345CF61B4D55972EA
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  persistencedefense_evasiondiscoveryexecutionhijackloaderremus_stealerinstallerloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Detects Remus stealer

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2