Extracted

• • Target
    recuva_professional__technician_(2026)_full_español_[mega].exe
  • Size 2.5MB
  • SHA256 0d3cfbf75728547266305947f868b38b74a0c66707fb2e7772148d61d66023b5
  • MD5 c98bd185534004863eb0ed84d05083f3
  • SHA1 01b3e33ef29280a115dd8a8bd55574edc8def983
  • SHA512 8af441d62290eee9da74f7584ff7ea660c39745ebe238ab10856d8e914edf0872323409e694f6b26e4422a3fa954059968e167fd6a7e2319bd272adb72d8f214
  • SSDEEP 24576:pdZy4GWmNXIV6xtOobjVFbzEb0Xp/tJbnRrbHnf+QPZ1Bele5UK2XwAMU2MXe5OR:pdZHGfNI6jOob55zH/tJFnAxD2
  • TLSH
    T1A3C53907BCA149EAC06DA33188A261A13B75BC051F3233D7AEA5B7383E727D09D79754
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealerpersistence

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2