Extracted

• • Target
    pokemon hentai version game 43.exe
  • Size 899.7MB
  • SHA256 d37d60f741ede109c179ab77d46ebe9dd96487b1468715a7e6bf7cb76b4701ea
  • MD5 425b6b4f4710cdbc274d43671e9e1872
  • SHA1 be24330e7ba05db85271a9e1c22607199fe25aa0
  • SHA512 1531f4cb0255f548c160feb59bae7bdaef148f428fafe0f8cbbedeb93ea03a97280fe3ba6d5983bb8a038904b651c2ebbc44c15719eed040352cf5e0521db637
  • SSDEEP 393216:xXLNZrxZpAaC56q9GOYypFNt3bu6xMiLY5lKcAROz6qnmGRgauD+9HlHMGxQc:xXLNZHqDjeh6SF
  • TLSH
    T190A9BF02B7F80066F5BB573489B79612AA76BC511B31C3DF1290B66D2E73BC09E34726
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  googlediscoveryremus_stealerpersistencephishingspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Detected potential entity reuse from brand GOOGLE.

    phishinggoogle
  behavioral1behavioral2