Extracted

• • Target
    component_2.exe
  • Size 2.1MB
  • SHA256 be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a
  • MD5 7e81a8f28d5cd3b1a247c11b5ae64366
  • SHA1 5291f0767ba9c4b4810611aceb26bb594ee19779
  • SHA512 65ec3046e0f9b1912e47d4bc5cb652b457c96495b69b18820c029fc41c68997de5dffd03f4442661d57552e9fb3e8135153d81d510b90e731245c219e2b26b56
  • SSDEEP 24576:vQlw6OELAIq3kUHRNcOmIiUmZ0pLBivHgPVA5lNRtxzBele5rK263xBirP:vQlvjLrqU6RHmIuZWLeHgPm1LgHir
  • TLSH
    T102A55A0B7CD009E9D4AAA33289B651967B75BC490F3223D72E90B7782F727D08D3A754
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealeradwarepersistenceransomware

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2behavioral3behavioral4