Extracted

• • Target
    file.exe
  • Size 3.3MB
  • SHA256 526ae427fececcdfb7d231d95a3a4f3ffa83c130ed5d58192daad06510f4ee69
  • MD5 d45dad3c505e89ac54acb6dbc86ec41e
  • SHA1 d9e22066987e02a6bd6e50fe3882109a1ad2567e
  • SHA512 9f594738c52f3ee15bc1bf64f5094a45654a7988d45b5cd9c629050ef0074b0e527d4e74795bc0c2bbd14e406624014b3e6ee9d3be38eb9f5483efba9720c215
  • SSDEEP 49152:ih+DpOIjw1yXYpexFaNpGHrZEf2m04Mfqn4epjK7i2/vx39lA5IxN4S:iADMI8kvxGKbm7AkEx7Cw5
  • TLSH
    T18DF522223F94D902D8AA1E718A70CBF81720FC1D8945DB9734E7AE1F7D9E6C75E02588
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryremus_stealerspywarestealerthemidatrojan

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral1behavioral2