Extracted

• • Target
    iuyuh.exe
  • Size 8.6MB
  • SHA256 dd8be6afd4ce72ace57a3a5c197301ecfc7453af937b0c511d50ddf27f5300e7
  • MD5 8d829995baecea761158263e02872e8e
  • SHA1 2d33f0c3c442b499ea3d330c782a5eba4689a81e
  • SHA512 9b353aa0a3329784aa0210c61848c7cfc30d82d3e082e4623010c32b6a9e0cf90009e83fdbf87291fec05e19731477887dd5df607d1d5aefd7b4ce7bdedf1210
  • SSDEEP 49152:kPDhDgMbz7ccFXhjE5yDMICe6MILTtoIFXW:kpgUCVMILTtK
  • TLSH
    T119964947ECD109E9C49AA33189B39296BB35BC481B3227D72E90B7782F727D06D36714
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealeradwarepersistenceransomware

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2