Extracted

• • Target
    jhgkuyyg.exe
  • Size 2.4MB
  • SHA256 d8f202a15c6d0ecb27229a8df34860d9c39cc16e3cd98054bda32a3bac8b898d
  • MD5 5dd60bfc3351e273a520564f0688a45e
  • SHA1 646f1c1713ab2707ca946d64e1557daa629159df
  • SHA512 dd07cc3b5687166fe4656613f9e6b9cae1f235ace22da35b1c2b3a63da077bc29c3baf54ab716f012f835b055f4ff95bb28563d61709054c342a87d5f81f18fa
  • SSDEEP 24576:eUOmTxoDkcIbJPJzaiPBZ4ySStboPJzQwABTRuG9NSaYK1ogvA2Bele5rK2y0HE6:eUOkxtc6PQ0QeRiQwARRpSa/1oW8bo
  • TLSH
    T153C54807BDA149E9C09E923189B751A67B75BC080F3223EB2E90B7782F72BD05D35B54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerpersistencespywarestealerexecution

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2