Extracted

• • Target
    _78aa82ebfae6c6ea690fad27bda96e3de794a5d8b26cb0d25f51b2cf045cbcde.exe
  • Size 2.0MB
  • SHA256 78aa82ebfae6c6ea690fad27bda96e3de794a5d8b26cb0d25f51b2cf045cbcde
  • MD5 951d55217430346bda00399c5ded48ec
  • SHA1 210d85ff366c036a083e1bd0821cbf6705cb3424
  • SHA512 957920e197211b49bf7c2c260c18846d6d4b60df77ad34b0c11aaaccb088b4d986a9dd7cf26cd4e633014ba92d9fd70e33b7dc0a3d302cc0ca59346953b4813b
  • SSDEEP 49152:nc6IApmosdqQGd9LHP9AZd97wuZ74f9JFVd2TELbTvKvZhi5wU:nodqxFPSHRyhLbT4hi5
  • TLSH
    T1119522E89B0ED143C4055B704D61E27C2A6A6D8DEA0083274FEE7EFF7876B1A98453C5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryevasionremus_stealerspywarestealertrojanadwarepersistence

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2