Extracted

• • Target
    recuva_professional__technician_(2026)_full_español_[mega].exe
  • Size 893.2MB
  • SHA256 b28077b9cfbe063924890493f2ad3d8fa4068c2947a5ba8eb024f5a1792596fa
  • MD5 6c00adc3c34e7d14a7b5076e50754e8a
  • SHA1 e521f7b6c599e0a52558461c1623395b96263de1
  • SHA512 0224bf0be33f72117e3a77ed1df62a0270e0a170736ed94836d2fb12bd1b9eba68d73d0fe898c43b29a53896c7ea1c074123a0ad36ded4a7812d8a67d7d14697
  • SSDEEP 98304:nNahwkXskSAmtPIyIMS56JPwtY3dUjyHRYW+cx9RxBHvIBL6+:nYo1lS52EYtUjyHtr5vIL
  • TLSH
    T115A9CE02BAE444A6E0BB933089B69652BB35BC551F3193CF2690B63C2F737D09E35716
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionremus_stealerpersistencespywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2