Extracted

• • Target
    grabbrunch_stage1.ps1
  • Size 1.7MB
  • SHA256 eb170eddf2fa4c6249628190d1771fd34cbeb075c1bc6ebc7acaf9b48efb049d
  • MD5 6f26cc26db7e6a21b526fe7322aac958
  • SHA1 8696f7a36bbc04b63845adc50a3ef3dd9a56a2df
  • SHA512 4c0f84bb05c72d368bdcc91510a46ea03ad705aa41f743210d6348799d29e9b0a6afef8fa296ac1fa7c0b8e5cf2509faed45307ba7c5d31ddcec90262096b059
  • SSDEEP 24576:c2Pj2qje9MM/PGSz/cNDw5k8TKTfqpC5o3W9FE5AoYjY9f:9jnIpY9FmVf
  • TLSH
    T17385AE01B9B990406DAD7B1A1032F7A761DED466C2FC8E6013787633A4CE9C9DCE98F5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryexecutionremus_stealerstealeradwarepersistenceransomwarespyware

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2