Extracted

• • Target
    file.7z
  • Size 20.6MB
  • SHA256 83ead2985b96eff3a8d5c8a0cc1a06703b1b0449dcc7e05932eb8c17ba97288c
  • MD5 7db6da3ce5f1a15cca8ec37bba32bfaf
  • SHA1 6f2748e9176436df302d623f9dff8e849713930b
  • SHA512 89dc402838521cfc3cfe17992f0a097d1aa3632b808c9746a89c0bc7e05ff7fa71cd328c412d9941a60a1b69b30e678a27c8f1fbea1350436205bf39159bb247
  • SSDEEP 393216:Hkx4s3LUiz5kee9AvIM8ITjXZYSspbPazEClSjLZCgf8KHQ+qMYioeSECKgBl:Hkxd7U0CeeevYKXZUGWwglHLoeSLdBl
  • TLSH
    T1AC27334E59AA26FE01CF6D744F2753C84138A40DFEB36CBEF1266A694004E678967F4C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2
• • Target
    appFile.exe
  • Size 866.5MB
  • SHA256 c6ed4c1bf59c1ef0ae8f3523e31ac4bbbc4530716d9e41af2b6b2d08fb96ce79
  • MD5 33a67f8ae9447c783a1669f156dbb53b
  • SHA1 8b7e6dfeb79795fedd92bd74a3240f38aac5590d
  • SHA512 fb9f27734537d386ea1dd6c17d68e0cd3b76b23cdf4c444b649076a62aa3b97d363c5e867da8527d32602d602ea2c515911fac96737421eba06aeb9e5d5922fd
  • SSDEEP 393216:Nno75odpGOAHaJLkCk1XsH7rBrZguhIYWluehh32+PO8SAx5iebt1ZAhCxZ/otWE:NnoOdoHqNUpLluUh32d8tZGH
  • TLSH
    T12C99BF02B7E80066F4BB963499B79612EA36BC611B31C3DF1294A66D1E737C0DE34727
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral3behavioral4