Extracted

• • Target
    ojujn.exe
  • Size 2.9MB
  • SHA256 72c5cec904df799ee47952dba0d830fccd58e49c4810db5261e85747d4495713
  • MD5 fc85c6ec73bec24c13e3c845b01f517c
  • SHA1 c2cea49d2daec034380b762d47dea91725311948
  • SHA512 31c653755e45a81efc8e9e428c37e5bd4745d1462992dfd059b7869ea4ce2e8a0453d1907af8a0b9c0a488d8a395ff63cec3a0e4322fec2277b8b1e1a2dda826
  • SSDEEP 24576:gn8IUJ3d7qcQ9yh1fV2CtSd1Gq/CahPQD1Aa2dRXgJ4JyvAoBele5I9D/K9nysJs:gn83pd7ey3fV2xHxCaY1P2HXgOpH36u
  • TLSH
    T1EFE54907EC9148F6C199A33289A686567B79BC081B3633E72EA0BB382F737D05D35754
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  remus_stealerstealerdiscoveryspywarepersistence

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3behavioral4