Extracted

• • Target
    2495fa3252c4ea53cc07a9622c8ae08561ae59c82a08684353496aec54b6d6dd.exe
  • Size 2.1MB
  • SHA256 2495fa3252c4ea53cc07a9622c8ae08561ae59c82a08684353496aec54b6d6dd
  • MD5 d6d4abc1ec6e0719c849efbdefc76769
  • SHA1 8cef56c14cd562aac3d5bc307103cc338c075e53
  • SHA512 ab4a064cd0fc4cf189679a05ebd00f76d5b1e0056d921c8ff9c8e1af1a65dee2fe8ee4cc7b8582a5fe449b1338f42cca9f4d583a3ac6ee9fb419d07be9e37e73
  • SSDEEP 49152:AapqrMeFf/pGV5A+uSeePPl3AK3NhRNj3a+SrlJ1s3Z:AapqA+f/wzAtyV3L9v9FSx8Z
  • TLSH
    T10DA533713DC8E262EEAA4B72D4D5D1A0A3AC970ADFB197C7359C032D2BD43E5903B905
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerstealeradwarepersistencespyware

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2