Extracted

• • Target
    beb.exe
  • Size 2.9MB
  • SHA256 cdc0d27aee64dbcc4b67a3a6cdde4c7f32065144d8fbb6ada691143456e7d756
  • MD5 43cb4e27e723dad9476b5907e60f7f44
  • SHA1 d13ff91e9a6fc4c6fb02a2e1e766d18859f84641
  • SHA512 1067803e6beb6eab1dff62cb400b8ca0838f9a8d8e4f637bd44a6686f6b1e1ace29f324e3a8add55d989c9592da2546d142cce9dc388e2eacba9831900e8a36c
  • SSDEEP 49152:xrq1vGKNOQSFPFEnxaxf7a7iH93IyKjpkFAU:xUSwnE93oU3
  • TLSH
    T112E55A17EC9148F6C199A33689A79246BB75BC081B3233EB2E907B382FB27D05D35754
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerstealerpersistencespyware

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3behavioral4