Extracted

• • Target
    ojujn.exe
  • Size 2.4MB
  • SHA256 746a58853d9fe375f106cc126291b01b5c6dbd486c805ae8ede0c77066c9f830
  • MD5 c9ffefe6123ad0c91544b2784e02f89d
  • SHA1 89d7a8908764f029f79c16f824d931a96830f90e
  • SHA512 02bd360485be5a57b1e91a5b4bfaeb1ff38f33778071a9d1860e6ccd8d7e5ff7c2b7125925c64a39cb565301dee336babdccaee98cebc040d21dc06da3b969c2
  • SSDEEP 24576:Ly2dc2l0XKGw1LiEQTuACWz3SmmfaZ9JS+xSSgohhw0bG18w22vA2Bele5rK2y0O:Ly2C2CKpLm4czL9JSBohg8AY
  • TLSH
    T1E3C54907BDA149E9C09E923198B752A67B75BC080F3223EB2E90B7782F767C05D35B54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerpersistencespywarestealerexecution

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2