Extracted

• • Target
    96a9d2e8a0af33f73a1435b9672dd22e65121bc5931ec3c130c8d062a01cf448
  • Size 15.8MB
  • SHA256 96a9d2e8a0af33f73a1435b9672dd22e65121bc5931ec3c130c8d062a01cf448
  • MD5 fe83a11f09f0e6213fba44fbc63e1851
  • SHA1 0393d5c241683fdbcdf5f1cb146572c675ba7637
  • SHA512 72dd700b16f315b64a62219397b1b2400c197fd7b0d39897fcf9a152e132e7ab29dafd3fd2433779bba82765e69c2e01d0173bf46f14acda615c210f5e5d88cf
  • SSDEEP 393216:DMvkFssNE0EL9nVsYngBQ5ZZlFnujGw6aran2iWT83tu5gm:DMviZNNEL9ne6gBQ55FQFRT8k5gm
  • TLSH
    T19BF6337BFB449CE1C928537EE53D4B19EFA5E06C2A8A7102311EDE906C72937425BDE0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryexecutionspywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $TEMP/Setup.vbs
  • Size 637B
  • SHA256 baa56b50510ec137c6189c4439a8be55aacdad30e7015c0399a04617b22188ef
  • MD5 b4da72e23ea406bafdcaf6901eec613b
  • SHA1 c1b0c170221db8ddf6af7e856c6e1df20dc63e1b
  • SHA512 77d465f8166966e5d09649bbf92333fb83b74c1cfe023bb28bd7ff9f3a41c063d0176a1830c5bdfe921c429724b84735c12c7b08e4ef15302051821249e1dad3
  • TLSH
    T176F0A2269D69DC658AD68993C1F7F90C875B60511323C1240A58FDA4F7319B40E05D87
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  discoveryexecutionspywarestealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral3behavioral4
• • Target
    $TEMP/data/.runner.ps1
  • Size 5KB
  • SHA256 8feb81a85463230b9df6626e464fe8c143bc38eebb44fd072ffc9824b5cf41f6
  • MD5 3151c2984b94055163047023cfe151e9
  • SHA1 a6d9ea15edd93bb56a563a273ceb24ee7201d594
  • SHA512 b257c873a667bbb055f21210e5d49bd65abfc42550acc41107576bb1d64dd0c80ce18cecea008c2634061c302d7f10bb742dcee1ff4c9fb150f7c3e88b788861
  • SSDEEP 96:t7w68JpKroHMmn+1C0Dey+TU5HkLllzl3Tfzl3kN/67CH0S8m23Fov:UCIzn+1C0Dey+TUBAl5l3Tbl3kNi7CUk
  • TLSH
    T1E8C173283A0BD19156BB7B2EDA5FE54EEF1A40371016D90036DDC6C4EF75A48C7A8B88
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionremus_stealerspywarestealerpersistence

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral5behavioral6
• • Target
    $TEMP/data/file1_parts/I1XRhj7JKqKn.part
  • Size 778KB
  • SHA256 efc96adf1c04c1a30dccd6f3e471b3b3862c8127ba394615d496056c6908c0d6
  • MD5 41ad8950414126553fc1c817f23e424d
  • SHA1 ac28263513ae412ac7537506eca9165bb8b0b6e2
  • SHA512 e177eec6ba6bc56830dfec20afe67dbf71e4b458426f76378e8b8946198c48e1f0681d133bf56850ff6808eb95c4782237f65a184553031fd0a4ec62844a9218
  • SSDEEP 24576:n6K1AZg7pP732P0pgBUHZyOS2fWTkpnC3:n6K1K+gBUcOSrSC3
  • TLSH
    T148056B29E28D61E8D216D174CB96A232E7B4B41907657EEB0B9ED6151FB3DD02F3E300
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    $TEMP/data/file2_parts/y0eohlQbbxVo.part
  • Size 285KB
  • SHA256 97a9341a22c95363f9a1d8e7544e84ce86d9b2515fb241a847c00f175cb67828
  • MD5 67060dc49c4ae8eaa81df8f9c40ef9ac
  • SHA1 c1ee5c8987c7ab4f2fbf4551643f50b485a22e3a
  • SHA512 bdbebed6648c8bf12780d9291c0ff11825b0d19e47ea88f2c44b56639aaf9af232449a6979d390657e5fce1b6ee64c6b1a44853688142dbd333e26e21bd95526
  • SSDEEP 3072:CvxCGg064D6ov7gRMznqRjssUpJuA9WDbw5mc5wj2ZAiL/Fg+OQIQx7OvJ9hnly7:Cv/h6WHjgRMKjgSAgqm14La+yVly7KG
  • TLSH
    T12D54E65B6CA580E8C0FEE134C667F612BD723068073837D72EA15AA10F66FE564BCB54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9
• • Target
    $TEMP/data/~run.bat
  • Size 486B
  • SHA256 526322589fa39b64752b778f95dbbd532833cc53a747aa236d96920f6f9a66c4
  • MD5 c7c8a3cd39d200bd4d823b2729d41550
  • SHA1 f88d0370d5e6b77ea923c31974a4a01cebfb8569
  • SHA512 f71fbadbd48dc5950ae860de1dadd40b081f83511bb7e8dfbed4ddde8f15d023b5a1d7ea1bbb30a38dcd1f9a06f58ebb3bc85a5a59779eeb80c03114f74bd9a0
  • TLSH
    T141F0E00D054A96173657E0F4C7227145926BF1415D2D98A0F65370E1E85F348EFEDDD4
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral11behavioral12