Extracted

• • Target
    remus.exe
  • Size 219KB
  • SHA256 c82df76eec8d28b99a294bc174433851aad21df208a7f27038bc3fd5af91db3a
  • MD5 015ca6dc0327be60d7ee89b2c92fd1fb
  • SHA1 f30db4c7e2a0d696528d3a193a8ab6aac2911bf8
  • SHA512 bfd91ccf47d7ab407ce3e6c267ce4c1717c7495aab3222a11eb9fff5e444d9b0e5d3f2cec45ba80a03955fc86b5d771970711bf9a884bc9d968447c4a5b9ea60
  • SSDEEP 3072:9SziFM0L3isiMJbXeEyqAbAMym8D68pnqWrrorGkM54YqV:cilJjOvB8DHAWH8HYq
  • TLSH
    T14424192BD25375FCE552C03852667232BB32BA3D47309EF70392D7359D21AC0AE79A25
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryadwarepersistencespywarestealer

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2