Extracted

• • Target
    hnmh.exe
  • Size 2.9MB
  • SHA256 f3feecf1f6fb2fec70747006dbb8a09b73dfeb8f54946a4d701c13fd71d4600c
  • MD5 ed4861335d1a898ce5b42d2bb1ab98f6
  • SHA1 33297bdf9799e478a11ad7215d5342cc9afe5c5e
  • SHA512 ed715e01cfac290a55e55bee0dd91072b22ca0897094dea398c3faa2ce80817bcb0ed67228632c5507b741c18362f28c3f0470e1b99f0eb42fb6a222246113c6
  • SSDEEP 49152:brO3SBS6OOnJ2yJIJaG52xo3zxQPp1CWr:bsmIH2YzxMSm
  • TLSH
    T125E53917EC9148F6C4A9A23189B78256BB75BC091B3233E72EA07B382F727D09D35754
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remus_stealerstealerdiscoverypersistencespyware

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3behavioral4