Extracted

• • Target
    file.exe
  • Size 1024KB
  • SHA256 2880c19f853059bae15a838d1320f728d3f681ff8bdfe22d455bc0335d317c7f
  • MD5 a5cd6f31554350d552c42dc0320c85cb
  • SHA1 2a67068602cd24a96338010fb040eccd08b60aa3
  • SHA512 fd1041f424dae761f88ed3ed0b40644d8dd2e774556407eb412ce23583953f3e0451da31144a98b4a4e6271bb89a432616cca7d681f8f5574dbf88f75040406d
  • SSDEEP 3072:P53+Z2c90aq86nJ4YvsaLuiv0SQyd9sODvm3klPnR8YQpl29p8:P53+Zz6JD0Gugdd9bvf/OC9p
  • TLSH
    T1F8253A5BB3E930F9E137C27985924A05EB72B4354721ABEF0360576A1F632D48D3EB21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondonutloaderremus_stealerloaderstealerspyware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2