Extracted

• • Target
    bjbh.exe
  • Size 2.9MB
  • SHA256 ccce59754ac625d60cda648debe4a3021b70a30bc8b85d9a7d5612b1b64ef52a
  • MD5 1b344651227f8909c586256a6e7541a2
  • SHA1 718574faa7708402d748edd30bc9deac049abad0
  • SHA512 0c33203a9a33b573420cb1824aa87a2b51b751daeb88bc75ffa78de909cfe921a76755be167a9e6d2f93e20006af5a89c805224a8a4e68c984e70f56357b251a
  • SSDEEP 49152:UQUSh1Uw7yIcPvdgIEr5Q3uNpwMwperL9:UM1AgTNmDgh
  • TLSH
    T19BE54A17EC9148F6C0A9A33689A786467B75BC081B3233EB2E907B382F727D05D35795
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remus_stealerstealerdiscoveryexecutionpersistencespyware

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2behavioral3behavioral4