Extracted

• • Target
    AccessibleMarshal.dll
  • Size 917KB
  • SHA256 602c6c390322a95cb1b472d26482d65a3abf13161d64a2c4e3b628a79031f2a3
  • MD5 b62acdc0ff460fac2434e3e83068329b
  • SHA1 acbc3a05735aba0ec908cf172189c5ea56771da5
  • SHA512 7ec47022915f7232acb42a59fd463c5c753870a2265674085d89d9c6df34565ff59a89b93a8198d1d17d09cd8231fe07e6a0afa93cb40570ea5ac78bf1805781
  • SSDEEP 12288:QnvfCiOQ/OC1qMMI7eomWTBvVMmTTfWBb128Pjs:QnvK3gZdiFWTBtMmffWBb128
  • TLSH
    T16D159D53B691927ED15AC0748387CA7AB635B0CA0231BDBB12E4EB303E96F615F1D718
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    freebl3.dll
  • Size 917KB
  • SHA256 935b491407fd8ece0fd092b549a93958ecaa3aadbe30fee4927f34d3c9935eb3
  • MD5 7a3f748915803877b442174414af6428
  • SHA1 9999a46ca2c12e3f5384f60da98ce2b67e756d80
  • SHA512 8548e0a4a65b109aa7a9673920326b21767b998a9d3ee642218bcf702a965754bfe73f12411c7d6913b8911edaff2ebdc6b3c734b2003576c69dff1d9623c582
  • SSDEEP 12288:PO5f6Zmw/OCLOlUdyxXZ8FmcDXlfn72U+28xwGgF:PO5iMKcUkZEmcDVfn72t28x
  • TLSH
    T17B158C53B691927EE15AC0748387CA7AB635B0CA0231BDBB16E4E7343E95F610F1DB18
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    gkcodecs.dll
  • Size 917KB
  • SHA256 ea60594234bcd793c56001ecb7c27acdef13c61949c364afad365cefc0fa136e
  • MD5 6834da4f663732bd1feed1dd087f1567
  • SHA1 8e6c82e7194eaa5a86599bca68ecc9e7c61a5937
  • SHA512 57729a8fa4848b12ef728dc33e7d46035015b8be169415e2409247d01d1ce9364ec6da2fd6c081fc539beebc4c2ceffaecee6f33f3ffc0159f9a8e74daf6b137
  • SSDEEP 12288:m1pUfA5J9/OC+6gExTP+/81PJWZfN4KxC28sNozkDM:mjUovoV8y/OPJUfN4oC283
  • TLSH
    T19F159D13B651927ED15AC0788347CA7AB635B0CA0231BDBB12E4EB343E89F955F1DB18
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    lgpllibs.dll
  • Size 918KB
  • SHA256 21547e4c3fc767671906a06016bb80f14b5ea6a43134347886f2130401531a02
  • MD5 6117211291d28383c9a74a4807c56872
  • SHA1 7ae8da8e437a028c48512138dc00c24839932e61
  • SHA512 a5de5b513bb91aa063fed80f10bb4b139989c70c76d60188dc50be1dad1ea637d1f962bd37129634f7f28fd98e77f4fcf45517bfd53da61705c09825db90cee8
  • SSDEEP 12288:P6NniKJ3Q/OCoHXM8v2NxeS0QHVf13M28cuQQ1:P6Ni8B3p8xX0Q1f13M28c
  • TLSH
    T1B1159D53B691927EE15AC0749387CA7ABA31B0CA0231BDBB16E4E7303E95F614F1D718
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    libEGL.dll
  • Size 2.9MB
  • SHA256 8efbab8699cfb1fe6262c600baa86d067f1d150630c40dac856429e4da1fcd51
  • MD5 788aa1c575353fd4ee8159bc0619fa55
  • SHA1 ff02b77c49d2928b07ed6d4b63c3a55f8ea3d25d
  • SHA512 b420b417e128cb5c9b2ed36691ccb1b8ef4862e27bbcf39852d7d3d5e319992df2ead45cc0106f4c301703ad2485f323fcb5df13d31376caaaa9a9feb6950b2d
  • SSDEEP 49152:3L/Kpwt0fDo/G2vGYu3ob/eIHBVGE8QIU6isfS90:3btDMamW8f+s
  • TLSH
    T18FE59E03E29591B8C06EF17983479A3EFA31B8CAD520B5AF1BE087313E65F505B0DB59
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9
• • Target
    libGLESv2.dll
  • Size 2.9MB
  • SHA256 a01ef28c7f06faaeacea710591dbada4dd8893bbcc9c01d453345d0ad9c5e65b
  • MD5 674f68ccca6db3bdd61c2c54482c3da0
  • SHA1 012d78bd2785ba85cbe2ce2c9e4aeb1afddd0a84
  • SHA512 9f14090104bfdf8017da25327e1ce64d5338dd42d19983b4bfc2675a30d8007ecf4ced1566651f652bb5cbde68018102ad0d13240a67108b9c43e1417331e31c
  • SSDEEP 49152:sI+5cIt8QVufnqrjbjKbi1RyoZNIGNjcYP8aIU6isT:slQftaXP1By+sT
  • TLSH
    T1D8E57C03E29591B8C06EF17993479A3EFA31B8CAC530B5AF1BE046313E69F505B0DB59
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11behavioral12
• • Target
    mozavcodec.dll
  • Size 1.1MB
  • SHA256 acb3604d61b2f5262801ec7bd837541ebf8d63ab8c267271366974834cc6bbaf
  • MD5 e50ed1d3250099df83e3ba8105790ffc
  • SHA1 9332af256d13056ab492067f5e8a321a78ad24b0
  • SHA512 48d949dd69bce67710f1b8db65b634558d9ad0d19987264ae295ead592c096be1c485a40f2bcdd4abb971a0bb167b23b319dc8d50d3c5c6e90a6b8c5376fd1a5
  • SSDEEP 12288:U4TjYp9udubiO+F9oQh/xXysF0PXYJOqv9mCcAU7SN8iaIVQzurU:89uk22ItNF0gJOqvXNU+N8ZT
  • TLSH
    T1C535AE57B291E27CD05AE074434B8A7EB532B4C99222BDBF16E4AB303EA5F554F1C708
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral13behavioral14
• • Target
    mozavutil.dll
  • Size 2.9MB
  • SHA256 4679cfa41c84deba3042607ef24e934230f35cd89068dcdd984d708aff11beb1
  • MD5 8ad14d1518432316f224eb6b16446516
  • SHA1 213b3663d0d429541d208210647630a155e24867
  • SHA512 4edd60e4c53cd5da96676bb3057c255626ca3d970bad6d76dfb79b6806ce7699204339e92d780269d7f6fdcab436e5b4be4bf4f177f9c7db0cd66ba27aa87233
  • SSDEEP 49152:1dY1yEU73ca+8XQ/KDmzFQdONu/GGk8+IU6is:1dy/U1AODN5+s
  • TLSH
    T143E58D03E29591BCC05EF1B987479A3EFA3578CAC520B96F1BE04A313E69F505B0DB19
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral15behavioral16
• • Target
    mozglue.dll
  • Size 831KB
  • SHA256 545688375f250dadc12b703eab466335aba2498df634b25cc9a4372b5292f2ff
  • MD5 8a2a3af77de1fd848d8645f35bb535ea
  • SHA1 db5cfa5a479b0584ee0c6ed128e490ef89e428cc
  • SHA512 92b38f95e51871c6eadf7e055969b8ca41203b8b2f27bd23dc23a7ca68ca5d16ae203d206bdea9636a878494c38b53c2eb9f93ef742bbf796d4fee31d6383dc7
  • SSDEEP 12288:HMSZWfeCGV4rLEce8tksbDWbHdMlkAiuUn8/fsoFe:sYpVjbJsbKbHalkAiuUn8X
  • TLSH
    T16E058D57B691A37ED54AD0744347897AB536F0CA0231BCBB10E4EB383E96E660F1CB18
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  behavioral17behavioral18
• • Target
    mozinference.dll
  • Size 917KB
  • SHA256 03bd6abac123fe2d874ed23e88558301b784b877dc970b9a9b331d8611471612
  • MD5 198046238448ef925bfd8682321c08e5
  • SHA1 9b831e20aa3c20b4250a7a3fa8221b6e6f3cdccb
  • SHA512 0b72634272629b804f4ebed8737822940d5e4f16b4c80429ae6e3535a9e97a62205529d9d367b332019fe16cff4968969bfb570d8843ba73d2d4bf9b350b8a95
  • SSDEEP 12288:qWayblqBm/OCpcWM1jV5efIxa8QIvWfAmL28NqnTc:qWvpgK9wHeENQI+fAmL28N
  • TLSH
    T11F159D13B69192BED15AC0748387CABAB635B0CA0231BDBB16E4EB343E95F515F1C718
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral19behavioral20
• • Target
    mozwer.dll
  • Size 917KB
  • SHA256 a9aa9858bae1224a431240b4b3b3455751701af29491c369782811b74b086806
  • MD5 1ebdc65090f278c67be32543829ec11a
  • SHA1 2f4a3aca791435b7ed39cd8c917d00f579105cd8
  • SHA512 2d8bd37d5253f2cfd1492155d7e6b71c0e2c4b67ada768d3105d58457e318a559094ed89ddecccdd072d38acdd81559aa93e6d0e1794bcf77c13824013560e8c
  • SSDEEP 12288:OTVkFiuZ/OCOvoMBeWFAUAHj3ZfN49xC28XYODM:OTV0XogEVAzHjpfN4zC28
  • TLSH
    T14F159D13B651927ED15AC0788347CA7AB635B0CA0231BDBB12E4EB343E89F955F1DB18
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral21behavioral22
• • Target
    msvcp140.dll
  • Size 540KB
  • SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
  • MD5 4e3fa9bd90ef020c14359639dc19312b
  • SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
  • SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
  • SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
  • TLSH
    T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral23behavioral24
• • Target
    notificationserver.dll
  • Size 818KB
  • SHA256 dece831bea93531324aa00d33c188f69a6a10132c38f00ded62c1bae357487b9
  • MD5 99d2c07a00973d8b3fc850276f8e51d3
  • SHA1 38341cf4b8d9cf1941c688cd4f283a3b4e72b8a6
  • SHA512 a0394f0f4b38c1c93b8c248425ae1a5618b949c0b2cf9a129da89940121b8d21383794e3a3456321e99efbcb4503772deb2b5ba779a16b69048190465b8eeb50
  • SSDEEP 12288:4VzyHUP7N5gZmPWsLEaGDnpj9F/AsUB8HF1u:4VjocAaGDnp//AsUB8H
  • TLSH
    T1C6059D93B691A2BDD14AD0748387897AB536F0CA0231BDBB11E4D7383E96F654F1CB18
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral25behavioral26
• • Target
    nss3.dll
  • Size 918KB
  • SHA256 a020eb6de27d7a9852a583026916e42934cc5f35084f8400fd94a6a3e7aab6c2
  • MD5 cdd36cb3242c5774756d2422e6d1c665
  • SHA1 840ce7cce54f42c964e516c4209020ac6f6ee783
  • SHA512 bf03c35048e86bb53e85977ce0f22725305c1d2181905243c335c2673ed59f27e8d90621ce0a9664a3bc308c0f7b827f15f18bbf20a2caca07be0fc4e990152a
  • SSDEEP 12288:u0uRSMIVNz/OC8zmZk8Ux44Tx4VXFwv9l8DlgbE8T3DJi:u0hB7AqehCEMXF+9l8SbE8D
  • TLSH
    T1E4158C53B291A2BED15AC074834BCA7BB636B0CA0231BDBB15E4E6343E95F514F1DB18
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral27behavioral28
• • Target
    nssutil3.dll
  • Size 6.2MB
  • SHA256 1cdb502652389e9ffb2880ad096b8690741acd6e962e2320359c5e45ca3ae495
  • MD5 764f0e16479e48049439ea198ede0500
  • SHA1 af4bcb3c364f183d91a9b5368269bb6d43b14418
  • SHA512 6272e183150ca57605dc9be365bc11a1aa74c362b7090e2c063bbbdd47e7828ab8a94d1efb45361615b9fdf3df207cd62a930b3a57f0c909040553075ee6b8ac
  • SSDEEP 49152:taklBqciFGiUx2YZ0TxTR0CO8b6TFADnKPlOGkFc949IRrNYl6zn3WRguUaSiCmL:6nYGODBUCZS3cVBamc2l8Pn
  • TLSH
    T1E7666B03E294C0FAC09EE2B5C747973EEA75B4C6D565B65F0BE40B212E25B649B0F708
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral29behavioral30
• • Target
    plugin-container.exe
  • Size 141KB
  • SHA256 b2f2b9a3a712125a06b303344b7a0dc57f91ee6f1749c731ca2260931dbe24e9
  • MD5 65729157b053d4d373595f7a53126298
  • SHA1 869db650f727615edb9c0f1d6d3db4c28e170250
  • SHA512 2651ab466c095e81dbff015ffe38b07eccd5a3f6aa1c7eece5a2f8d74066f72784631cdf0867d42cdeb8781434f641057ecedf70fbf506d641f6fd59e83d4061
  • SSDEEP 3072:4lkeMqT556AJH8/UQX3QlDydb7lX60BZENkr2Zn80gEjH:vpqvXJHcXgFCHlXLokry8pK
  • TLSH
    T1FCE35A13FA5850FAD559C934DA924512EFB2B8860B20B7DF23944DA12FA5BE4BF3D340
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionremus_stealerspywarestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral31
• • Target
    softokn3.dll
  • Size 918KB
  • SHA256 1601612ef34e7199e0fc73feaa95870ddd25a67234aa1957c007740106e679e0
  • MD5 e599bda5bf96c05bce1cf53b9f41127d
  • SHA1 0407a948ec2d9715d97792386ef693e3434214b3
  • SHA512 a7c645926c7b47137c2d42e7f85e6f38481e3c1ea5a145fefb0117e493f3688ebdc1bfa02593330ea16a2e043eb950c7a20e437ccf63c7d18950804f78c40d3e
  • SSDEEP 12288:ey++BT0E/OCnw5ZZxtgDX6Vg2tRoumYD8qHgF:ey+mAmKngDqVgSoumYD8q
  • TLSH
    T148159D43B691927EE15AC074838BCA7AB635B4CA0231BDBB16E4E7343E85F511F1DB18
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral32