Extracted

• • Target
    kliulij.exe
  • Size 2.4MB
  • SHA256 b3a79fbfcdd287765708970ae1ed1e6da86b7544ba3dc807e5254e009a46acf1
  • MD5 33793adf34bd6458e99bcff481451bde
  • SHA1 1be21e84579f3c8215df67d4f7ce4b4516599ccd
  • SHA512 e3b128615d1b161c07a9d61a1e8938b7c6c34aa54cc5b3bf40aade5382db9c91635c52517a88547a5a68176aa0685f78815d833ce0a825636be0687eb20cc921
  • SSDEEP 24576:zywcHQAOTbyVqd7vxVM5I17bavrrPUPGRyaXcd4Y7Fy8vA2Bele5rK2y0HEeW2mz:zywWQLuQvnMwfaDYuRyaXyz7FT8kG
  • TLSH
    T10AC54907BDA149E9C09E923199B751A67B74BC080F3223EB2E90B7782F72BD05D35B54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerpersistencespywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2