Extracted

• • Target
    beb.exe
  • Size 2.4MB
  • SHA256 523dd77b85d0b0cedc99ca23bc7225d4137b9e562a71a2d6d5e163e703680e2e
  • MD5 21c69a56c0223a76ed12a8816c303bd5
  • SHA1 53179f70b061beb209430d34c89c01557bfb0bb2
  • SHA512 fff3cc9736f514739672bfa0466a5120b9ef1d08e93830e3e27038e779d1a5caecbcf49a386909bb78ca86707cde28c40695bc748758becb2c92df46bf10c0a2
  • SSDEEP 49152:dOP+lTMeV21ELlcdhqTpGPtGtpBSbT8bC:dfNehq8IrSp
  • TLSH
    T199C54907BDA149E9C09E923198B752A67B75BC080F3223EB2E9077782F72BD05D35B54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remus_stealerstealerdiscoverypersistencespyware

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2