Extracted

• • Target
    adobe_after_effects_2025_v25.6_(x64)_pre-cracked.exe
  • Size 803.5MB
  • SHA256 400beaa8237db441d26b3abb71530f58f774855218ffe9aa1fed2dfa52a7bbb3
  • MD5 08fe41bb3fb4ad3ccabc8f6af4c1816e
  • SHA1 1a1e65e18960555719f47e97402195eabc244fa0
  • SHA512 1886d36dda77119c684f5a4d72b294b86c89ab1e161b5793bac563564d55015b4d042112f9b212e17c304896ece9f9321ef2c01280188dd661036f7e18733a8e
  • SSDEEP 393216:eaugNfxwMAhZtPTEupZMp9TdSraR/U5LhX6N5LH5ox3IdeLkBn0rHrni3ITWuy:efhj3+dd2alcLVx3IdeLkBqDi3I
  • TLSH
    T11699BF02B7E80066F5BB973499B78612EA36BC511B31C3DF1694A26D2E737C09F34726
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerpersistencespywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2