Extracted

Extracted

• • Target
    code.ps1
  • Size 78B
  • SHA256 197659a7b09c1580b3b5da1edd4e8adf53e5d0b9150809f286fda12fc7796bde
  • MD5 f775e5cbdf94aa45848c4bd7a1480c58
  • SHA1 4ed91eb1e484c1ef11c9b4602e8bea5ce44ad9af
  • SHA512 157f57e31f2ba9099228f2565199635f4877da606ae6770fc683a0b7e8e676340e8938453cd527772690e8762319fe36f7b4c9291f8fb88f3f6a1e42a6e6156c
  • TLSH
    T15EA012300B82C1948954105DF1515080AF30200401F265B5240480CF1D70D548900814
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executiondefense_evasiondiscoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2