Extracted

• • Target
    1/1.exe
  • Size 1.4MB
  • SHA256 787acc73bc4a72114d25a81c194be01a8b736ba0f61fbaced6f807a96c463c52
  • MD5 c8ae7917d20ce5642301720d7401109b
  • SHA1 431fe1437190db80cadce1e1fb758fa22d89c5a0
  • SHA512 97501519a8c229ae5e6550ee273a848d58163b87d2f768f2fed6ffd044d63166d96bb837ea168d6de6ad183c1f0757da9b706e566c11456880d688a4930a2089
  • SSDEEP 24576:+uY8YTop7BhkqE8iVUAYVlq+JZ+nVJirGbQxCkUrEQ78l+SvTGlunahC4Y:+uY8j7m8NVL+nVJirZO/8lfSlEah
  • TLSH
    T16265235772F48465F0B6477088F341BACA32BCB157B52ADF2284B97E2E73AC0A136751
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1
• • Target
    7za.exe
  • Size 839KB
  • SHA256 0c1874ed0b16b12d4adbb56a89a009a7647337fa509bc90ff00189d92dd46925
  • MD5 4d3c1bffc7d1cb8f9539d3d5856646e2
  • SHA1 c33c0a5de8dfb721024e8bf35884a0becc4c4041
  • SHA512 8e5f6eae54d3d8d936a73be54b3f9508191eaa4e4d8c72b80de6df666749fccfd3ed66d29a4af80bcf7364ed5ebe9afaf8cfcd598cb0e0d68bfeafe2b84d6ca1
  • SSDEEP 24576:+cyxh7By5I3a+m8H/v9rgC1zCjz/qNdChzDsa4X+we:+cU7Ssa+m09UAWzKRa0e
  • TLSH
    T19F05AE127BE5D0BBD25211318B1DBBF691F993680B2448CB67808F5C7B319D1DA3AA1F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral2