Extracted

• • Target
    sosermasn.exe
  • Size 286KB
  • SHA256 746c06f05b8e3bc93d6495a6c447c3c1874bd77011c33b0bcfe74ae27addbfaf
  • MD5 474de2155ee5c575d408806412c90411
  • SHA1 6ce65e50e8b91686e401e7fda41935a04503a2a6
  • SHA512 5416dc55ece60cea13ba40c0ff4f32380733856a3c40758a9e5f11ad18938221650ad107ce3b9bd78ba9df5cdd18994b7afd4b3ac088dd58b803985f404095f9
  • SSDEEP 3072:RIRFzY0sWUjOkFE8cH9yn5XYITuozPMwVC/5EIa6ooauBoLTwIzIud5OdgMHf89l:G++Y5ICuo798HkBHz79xP2R1DP
  • TLSH
    T1EC548E59B79958FAEE77813CC9524605EA727C124760DBCF03A04AA72F237E09E3E711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydonutloaderremus_stealerloaderspywarestealerpersistence

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2