Extracted

• • Target
    hnmh.exe
  • Size 2.4MB
  • SHA256 116e6d06ce45806d7b1a59b3cfb7544fd0be3ec345d62a02cbac11ca4275e086
  • MD5 6adea3d32ee70316c9f97f13e69acbdf
  • SHA1 816882dfc72cc823a94388424e9714fb2c7da455
  • SHA512 438a1acba053e8fe3f935bf4f6227d7e1229aa477d8ab53cd0d814c5972c266ec549110b20fd76dee22c885d15170a9dfec8755066ad212974e4b9ab41a90e2c
  • SSDEEP 24576:h72cxcIwmf//fnLoomuwYITBiLlf5TLzY6sC7vdtb2eqYDEbxvA2Bele5rK2y0H9:h72wcWfvnAeYeXLzY6RdDqX/8J
  • TLSH
    T19FC54907BDA149E9C09EA23199B751A67B75BC080F3223EB2E90B7782F727D05C35B54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealerpersistence

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2