Extracted

• • Target
    QuickFetch.exe
  • Size 1.4MB
  • SHA256 d9824b3a6894de0606a03a23417f1c7e780ee0b5655f724dbfa455601e13eb8e
  • MD5 3fa9ff04979f656ba3975f6ec98efcba
  • SHA1 5203a18ead55b15a7cfba434fcdbbd7281de8fe1
  • SHA512 37a61dcce6675a97f4f0f3b0951e545d38386455679340805158b295a90cf4619c637e4a8935095453f987a31cb71e7661983c0c884000ce0c24f95ce80a8b6a
  • SSDEEP 24576:2vj0f+jhnPvPy/8tdGag0q3DAu/33bwRu+Yb6mQR5+b4qcNcjXT/:sgWjhX+8tdS0qZ8Eh6mQR56eaXT
  • TLSH
    T1C165232246E48517E6A40FF408FA42A30531BCE2577A91FF33C69D4C1567BE1663A3FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4