Extracted

• • Target
    mpclient.dll
  • Size 3.1MB
  • SHA256 26a01f1a3414868796b07501fb6a7f2f2be29bcc80af09a22571a2f74f34f1b2
  • MD5 f612d1a246608e1545bef4ab398ebda1
  • SHA1 8707c27b90fe3444501ec78b806a3cf6cb66d39e
  • SHA512 1fa020329041a14f1c24f3f58b5b9136eb62d303dd5b16d787995e2f39fae57cbcb3902018d767ef9a75221af6e87968ad46c64c28817b313d54e84773d1cec8
  • SSDEEP 24576:r05JKx81mVroixjy1MTMC3PvZi0vRepTXbWiyQgsV7IKV5pOJzPZ1Bele5UK2VPr:r05JS81Mrxjy1M13nZ5vqRV9pTrGSSa
  • TLSH
    T17BE56A47ECD11CABC0AAA37189B652953B3DFC041B3263D72AA0B73A2E727D09D35754
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware
  behavioral1behavioral2