Extracted

• • Target
    ws-Setup-Complete.exe
  • Size 3.1MB
  • SHA256 fde7039a7b78ed36845d67fe5799e9185bbf753f78de7c8fbde423812fd74299
  • MD5 202e055e07bd31f372dfb6d652eac8ef
  • SHA1 c0189aa9a22dae0d99e5aad7ed368e037e19d96e
  • SHA512 47b1a58238cd3134e3879b27d0f55f55119f687c366f0fedc384d0bd6d554b389fdfa80b3b725b01ba7972e621586c8f3270170bd8f057c2dfabcb1960908af0
  • SSDEEP 49152:o+K3EwPd4g98d2x1fUMySjhjQijM6bpaur5:oRHjBMsH0u1
  • TLSH
    T18BE53907BD9108E6C09AE63189B652527B74BC4D1B3233DB2E90BBB82F727D05D39B54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2