Remotium-Windows[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Remotium-Windows.exe
Size 23.7MB
Sample260705-g1jd7set5q
SHA256 f76ade0a9ee122a3a1f1d50e398ed15bd3aa7a1c009075248250cd22298f9ff3
MD5 5768d00f68f9a359f8603b7d26b49f0b
SHA1 0c930935c8d4e8192c7119362ead24ec071b3a46
SHA512 03fa0c5acf47ae3ed01e347fd1735ddd00401479990f6df9eb0417b1cfa18816cf97757fd9d04cf3da13d0577c8d598f9d4545235a78f02e3532ba9ab2210e93
SSDEEP 393216:Ab9nR4x4OUWejbZ6bc7/z2khJvpNXMOBZsffIdCqdOy80Ma6Z6BxrkE:+9nR4xL0tvhJRRneff6wy80M7Z6Hk
TLSH
T152473326F28A1C79E41ACC7096454A32A6393CA557321EFB53C836A43F7BDD00B3B795
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Remotium-Windows.exe

File Explorer

Remotium-Windows.exe

.exe 23.7MB

Remotium-Windows.exe

IMPHASH 1728f5830d9188240379efd54db72133
SHA256 f76ade0a9ee122a3a1f1d50e398ed15bd3aa7a1c009075248250cd22298f9ff3
MD5 5768d00f68f9a359f8603b7d26b49f0b
SHA1 0c930935c8d4e8192c7119362ead24ec071b3a46
SHA512 03fa0c5acf47ae3ed01e347fd1735ddd00401479990f6df9eb0417b1cfa18816cf97757fd9d04cf3da13d0577c8d598f9d4545235a78f02e3532ba9ab2210e93
SSDEEP 393216:Ab9nR4x4OUWejbZ6bc7/z2khJvpNXMOBZsffIdCqdOy80Ma6Z6BxrkE:+9nR4xL0tvhJRRneff6wy80M7Z6Hk
TLSH
T152473326F28A1C79E41ACC7096454A32A6393CA557321EFB53C836A43F7BDD00B3B795
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

307880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetProcessHeap HeapAlloc FormatMessageW GetTempPathW GetTempFileNameW CreateActCtxW ActivateActCtx DeleteFileW HeapSize GetModuleHandleW LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx GetProcAddress FlsFree FlushFileBuffers AddVectoredExceptionHandler SetThreadStackGuarantee GetConsoleOutputCP HeapReAlloc AcquireSRWLockExclusive ReleaseSRWLockExclusive FlsSetValue FlsGetValue FlsAlloc GetCommandLineW lstrlenW GetProcessId GetFileInformationByHandleEx WaitForMultipleObjects GetOverlappedResult WaitForSingleObject GetExitCodeProcess CopyFileExW AcquireSRWLockShared ReleaseSRWLockShared GetStringTypeW DuplicateHandle GetFileType SetStdHandle SetEnvironmentVariableW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetWindowsDirectoryW GetCommandLineA GetModuleHandleExW TerminateProcess ExitProcess WriteFile RtlPcToFileHeader LoadLibraryExW TlsFree GetSystemDirectoryW QueryPerformanceCounter Sleep TlsSetValue QueryPerformanceFrequency CreateWaitableTimerExW SetWaitableTimer TlsGetValue GetModuleHandleA GetCurrentThread TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode TlsAlloc MultiByteToWideChar WriteConsoleW GetCurrentProcess GetEnvironmentVariableW GetModuleFileNameW CreateFileW GetFileInformationByHandle InitializeCriticalSectionAndSpinCount GetFullPathNameW CreateDirectoryW FindFirstFileW FindClose GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal CreateProcessW GetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList SetLastError GetCurrentProcessId CreateNamedPipeW CreateThread ReadFileEx SleepEx WriteFileEx SetFilePointerEx CreateEventW CancelIo ReadFile GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry CreateMutexA WaitForSingleObjectEx LoadLibraryA ReleaseMutex RtlVirtualUnwind SetFileInformationByHandle SwitchToThread DeleteCriticalSection LeaveCriticalSection HeapFree EnterCriticalSection RaiseException CloseHandle GetLastError GetSystemTimeAsFileTime FreeLibrary EncodePointer GetCurrentThreadId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx

ntdll

RtlGetVersion NtCreateFile NtReadFile NtWriteFile RtlNtStatusToDosError

ole32

CoInitialize CoCreateInstance CoTaskMemFree

comctl32

SetWindowSubclass GetWindowSubclass InitCommonControlsEx DefSubclassProc RemoveWindowSubclass

user32

GetDC GetMenuItemCount DestroyMenu DefWindowProcW ShowWindow DispatchMessageW DestroyWindow ReleaseDC DeleteMenu GetAncestor GetMessageW GetMenuItemID GetSubMenu GetClassNameW AllowSetForegroundWindow GetParent SetParent SendMessageW PostMessageW EnumChildWindows SetWindowPos IsWindow GetMonitorInfoW MonitorFromWindow AdjustWindowRectEx CreateWindowExW RegisterClassExW LoadCursorW SendNotifyMessageW GetClientRect IsDialogMessageW TranslateMessage

gdi32

DeleteObject CreateDIBSection CreateSolidBrush

shell32

SHGetKnownFolderPath DragFinish

shlwapi

SHCreateMemStream

windowscodecs

WICConvertBitmapSource

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

Name

.text

Size

358KB

Virtual Size

357KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

23.3MB

Virtual Size

23.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Remotium-Windows.exe

kernel32

ntdll

ole32

comctl32

user32

gdi32

shell32

shlwapi

windowscodecs

bcrypt

advapi32

generic