Extracted

• • Target
    pawwing feeling final apk.exe
  • Size 785.2MB
  • SHA256 2e7ca7bca7d86ce8716d6d9ef5138f54b31e5ba687dd7f7bfef0e7fb81827fd6
  • MD5 33b18573fb3f7f1334e9bb11b1146e7d
  • SHA1 ea67b4cb0381d6cf896b57621fcb2a2370c06429
  • SHA512 79379f1453df913a116af3b9cf5b6f3067a997bd880a7fd25fea746a363f813532dfeaf0a78452f9e9604a1075ae7890e498aeffdb01539f3011786526991446
  • SSDEEP 393216:2kBBV/e/x6aY5X6e9U/FJfQut09Jpo8g1M3IdeLkByfQP6Q:2krVgri9qfQuG9J53IdeLkByoP
  • TLSH
    T1D089BE02B7F80065F5BB563499B79A12EA36BC611B31C3DF1290A26D1E73BC0DE35726
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryexecutionremus_stealerinstallerpersistencespywarestealertrojan

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2