Extracted

• • Target
    uploads_Bootsехеcr64.zip
  • Size 5.9MB
  • SHA256 53c1b122a6efa3101aad162c87acf493aa7b33ec874695d909e89e24fa78059e
  • MD5 e0d8d804877f7b3b39686b7fc5814003
  • SHA1 69bce0ee8b6eb97fbfafa58a3125dd86119e043c
  • SHA512 d7b97752ece37355bef1ba218e16c0b7bfa593166308dd3e09fb7b35221129dc0c389280a68d851fd51bf394174b7263fa90ea1ac113e3869d2c49b9490d828b
  • SSDEEP 98304:iIg1JCA00NVLahVLVmQml7HIOBAIxpGsJVqmBEEiU/1+F5HU+rJxfp93cIjSOvz6:iHJC/0NVGhVqkOBVQsJV2NUNeVU+vfpy
  • TLSH
    T1D256332F6C1FDE96E3428212BB69A56DE18F0DE5C8B4F571050008FBFD9705A92D8B1E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    ReadME.txt
  • Size 98B
  • SHA256 517ad37fff3b852a55aa7aac2c02dfbb5f1116fbe3d74c1a4ab3ac2132fd91f2
  • MD5 26590565d252e1e56a5bd55c6723d051
  • SHA1 42fe98bd6415cf3431e7e6e17593ca27f80aad6a
  • SHA512 62d58f3d421b0d17ec7bd89896cae4f4d534c4babf435cfea61a0ab375caf3610f7cf8b7c5b178f05d2e28c8e45060e12f8d841f525a768a270fa49a7eb73d27
  • TLSH
    T134B012D3D20A843223C0B4403B0921E0954B480CB147C941FD21D07D138408C8961ACE
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10

  ransomware
  behavioral3behavioral4
• • Target
    RobloxApp.zip
  • Size 5.9MB
  • SHA256 d20a97a6c9ba14b83d1b618bebd689ddd623ade6bcf6a0d7791a981624ff0261
  • MD5 8ef02f832a567ba2f2ebb6d17b73e367
  • SHA1 e85da825152d8853ae5f69885b28b1a4d3e540fb
  • SHA512 1b536ac95c7e6bcd8e22796f342342ae409b5c0fab8c6c5f11152ba35a15fc8e72177bff5a08ca48f0cc5b71c02193d5c5845bd3c79e2d9be059a397699e833d
  • SSDEEP 98304:tz/90lTghFn4D0+dSRb27yKzKiSiMz+OGQC4dxBK1hUCAQl7xJAqyfsC76GR73B6:VWghFn4o+MRI2ilOGQ3dHpxfsC+GBBi3
  • TLSH
    T1CF563398D32F3BC08A24E075BFE4D78118510669C448F7FAB529C7C398DEB8E93497A5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    Bootsехеcr64.exe
  • Size 894.3MB
  • SHA256 95ba067d92587b07c5dac63bacfe90c5b68c0ca9a85f6f31bd4c21b4e30427f6
  • MD5 1fb11f3f690b4d30b55264ffbf1bb363
  • SHA1 f179aa859621d55eb49c5d026ed7c1e54480fe0e
  • SHA512 c6c3ef4be06a4caf247e729d9ea7d64c0ac0d05557690fa1292f58405ba2a870c0c1b0854dff852538e34551def015b3d1461c7abdfa410040f1abb724be1c98
  • SSDEEP 24576:4GPAccCL1D7eLWIkeQQuJrvAIiKJ5KDddy+2Sp9Y1AG9xVZ3MpkldzBeletrKDXN:4GPlca1PTeULAIHwD/j9YHHHME8xbf
  • TLSH
    T17DA95A077CE049EAC4A9933189B751927B71BC084B3273D72E90BA782F72BD09D76B54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral7behavioral8
• • Target
    locales/hi.pak
  • Size 787KB
  • SHA256 eda355e3785313e3d982c1d3652266dce1b6e08832056fe58854b825e0712ca5
  • MD5 1185163466551aacae45329c93e92a91
  • SHA1 0dcbfed274934991966ce666d6d941cfe8366323
  • SHA512 6fad3e24eb868acf78db0591c7ba77abc84e92cda28e8bffee435ea89940a8607e7628c6c5159349377a8d933f373db2dfa4e5715ca404bc3e67fd4a0f22a606
  • SSDEEP 3072:4m//Yxz8BS65Ob5EeQzFc67R7dk5Sv34QAEm5dmLrsoe4GR3doInN8edYbOqGPt5:rYZ895O9ExFlReg5R5HQO4
  • TLSH
    T11805180CEBBEF3B55DEC3C8A32890D37D59D3674A3E9521348D5B3DB9844CB4146A2A2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral10behavioral9
• • Target
    locales/locales/af.pak
  • Size 327KB
  • SHA256 b1987cdcbb8d76598422aa1739a246ed6690dc1b211f950fcbf2f040491ed7a8
  • MD5 c9312ff081e600e5fb4483b46ddd7c23
  • SHA1 1ff05a6a06cc73caf2d7545a3821d90c228ac0af
  • SHA512 20c136b44770aa0e06259687656675a3e14310ea4e8ba214726b216bc1bcad6026267bf0132cbca642c0b5c49293386d0a1bd93ba40e1c33b648ae70416e8898
  • SSDEEP 6144:ZP+kgc+kVWlEvC9Z5D49Em7kLjB6oAYxjYgDbwxesB+xSK1IA3y25tHwDwv22iGe:ZPfclEvC2im4LjB6oAYxjYgDbwAVSK16
  • TLSH
    T170641B0ADB80273D05E07696FA0445F7BB9CB26DD770B2BADD9981321962EFC01BD1D8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral11behavioral12
• • Target
    locales/locales/sk.pak
  • Size 383KB
  • SHA256 dbd82a2a08f8e9ba9581b2672bc49e0fa5c89f073b58f152225f9e2815228ddf
  • MD5 989d000fbe286c0fd4bfb35305b52f48
  • SHA1 5a30a2cc1abe9977b1ffc4c4712452e6d55bc7df
  • SHA512 ed57c66237d5226d4d5cb63e98248c0df9d381ef86b6d4ef339523f430c54aab14f84121e05e9fedaf273323ec04b8a539c0aeb791245858890126de2ce38283
  • SSDEEP 6144:HX/6WrhCQ+koL+vMFVxyXiFJ7VC35hJYLjaQ3yGLBGR:HX/6Wr8Q2hnxyXiHVO5hJYLjaQ3yGL2
  • TLSH
    T1BD845E3FCFE61C1E8E990108DEF57210F9BE4690864DA4A6D44F328724E37DD9AB8D49
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral13behavioral14
• • Target
    locales/locales/sl.pak
  • Size 369KB
  • SHA256 d0415bfa061b36a6eb93fa2c78563448da8b63c91e0523086c7eb2714933ab99
  • MD5 234e628a62f822bd7b3546b91e79cab2
  • SHA1 10f48382495bdbfa3b30c15b91768817df13d828
  • SHA512 51234fc3fb5199a3a86dcb7ca68d3c471f1b97897b1a9f90139cfff9846a6c6fd039a0c817e7611e0e59637746cc51045f6ce493cd6f2d4e144fec1c6a561456
  • SSDEEP 6144:mK8+KqhWYynnbANj7nHZiGm4ocyxPbPDZFu+Hr7ftjQLm55gdrcKx6EIbi/fzMNS:z8+awi91L55Arc7EMi/fzMiqg
  • TLSH
    T1EB842B35ABA75E0E0DAA66CBFDB203017BDC048CD641D6A6FC4F33695012B2827BD599
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral15behavioral16
• • Target
    locales/locales/sr.pak
  • Size 572KB
  • SHA256 d459c1a781ddc344de76558211983dd07d47e3ca6cacffb518043bd78dc48fbe
  • MD5 aa4e2e54b648f66794f485318651b730
  • SHA1 18c1d5badcc5c05dfcf9e68df66f53c69e33e0ab
  • SHA512 cda7b189f48f28463d045174f3641f16737288b159adcf41da0c131a05a396a40e562b2f0aa10b08d323290f19d864755f238b074a698efa3c573d2b5512948d
  • SSDEEP 12288:AqOufVklJRr1HI/Y11PPeHyxsYQf5uaxbbNK6374Xzt/k/t:AVIkh3HNcf53xnZ
  • TLSH
    T1EDC457B19B9E64DB0501F41BD808BE493DAF41FE3FAB975611201DBD34E20B847B929E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral17behavioral18
• • Target
    locales/locales/sv.pak
  • Size 334KB
  • SHA256 3f0acf6f6319636c3e72cdc392b7b80ab0cfd8ae1a5a8e319624e4b46bcd3c42
  • MD5 c5437bb175fed93e85c5e7caf76ff352
  • SHA1 0d74f7df049ea73a47fe93b75c98e356b9bdd4b7
  • SHA512 00af14e7d89a12f4f39fb45a3f9c136e20c06752f98fdedbad426ac9a5b820260a329059659cd82fd089ab1d94c1f51ab4202fb6b142b27538d0139e67877239
  • SSDEEP 6144:UIcs6Ou/WpIjSwjcT+BjxEEkb/LX6uTSOoDE/xUDSS35655egbH:It/vjtBok5U5h
  • TLSH
    T1D5743B428A20F536FBB2170DB904115F4ADDE15CE7E2848E78D9883DAE87D9845FF24B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral19behavioral20
• • Target
    locales/locales/sw.pak
  • Size 351KB
  • SHA256 dea6947693fceb6457801d912ea7c716add3c0cfb4c34782a9cfa4c4e06b9402
  • MD5 e37fc1c3dce484bd0ce496f548f14a43
  • SHA1 02b088a11363b0a4c0527053669af32737f1403b
  • SHA512 c5c39d54f4eb6b0659903ce9b5c8804a750a254bf88cc7c6e729e7813ecbbcc88df882af9294b5b795ef5b8afe8f1a60fcb46b3929a9b2cdf41c84188e5852b2
  • SSDEEP 6144:HhUmBklgBZcaZwoRdkN6Csdq0rnKKcLLK+9s35FSaDN+q5CwAyeKnHwQ0/:mplGCkp9KhHW35gyCHyG
  • TLSH
    T1E974E76288B1D0195733518603D8FF7317DCED9C292B28A35A46BF4F218F98C57ABE49
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral21behavioral22
• • Target
    locales/locales/ta.pak
  • Size 899KB
  • SHA256 e0421b4cf2736bb465ec02cd85c2df09809f86479cb7624195373f25edbcedd3
  • MD5 5002d84bffb908a2dcc7e1b69836c265
  • SHA1 4cbbe387a6744aa6c51b15b5a3a223135a3f6115
  • SHA512 c2a4a46a27304eb080b066f049d2eae733470dbf0f8107220049eaefdd73fd8b41abd1b02b4a2ee6934b4cae18de97bca5360022a8e295427a0bd63603bec410
  • SSDEEP 1536:gozNJu8JvUHZZvrdAYWSXR1q+y5fNU1prH+O8ep3EvFZRj2IpewYxg3ZHa4dpeJT:gsNJvUXdWSXRUlUj9yw5fG7zWtRjcA2S
  • TLSH
    T159151CCE923EEE890F93288F0319536912996155C07BE3A27C756E1298ECC5DDF3427E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral23behavioral24
• • Target
    locales/locales/te.pak
  • Size 836KB
  • SHA256 f53e06181c9fa0f6028906a7388fd4e8f000ffb7277330634462433d34572395
  • MD5 b1a4d471fd8af54dfb8ff252246bfde1
  • SHA1 2044ee38f8d8d76176a735e726de189feac14985
  • SHA512 18248d3fa8f4cc409788d28a244889230b074fff416ba5998f25f3b67ad0c627172a5e7e3947e61e72ce28a5b4cb2134d6627b6252b3d282b54f84b424136c87
  • SSDEEP 12288:VluBe3p1F9fBiTlbUYgiNFOSdrUH4GrQKZkC28+5HX0Dkq9GyAdsoAkhodSMtS6f:VlUh4D5nM2
  • TLSH
    T14B0592023A6AD310DAE70273752CF66C49681B8161D6732C1EAFA357FB87D7E0843676
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral25behavioral26
• • Target
    locales/locales/th.pak
  • Size 704KB
  • SHA256 4fe2b7b6886e3ce068be0b7a0a71d45756eb797eda1e7d4fad52ab8a370e8336
  • MD5 85f59bf2f1167e34ab2b666608805420
  • SHA1 f0d8e8fc644c15c52c5f9d3419f88e6072799736
  • SHA512 86d6061895c996ad1caa3f3871c014b656e7ba7bb91f05c72a591cb5877c3db61965bc1a5094dcf7c4127d11f8106622355464704fd0695372627d8400a16ddd
  • SSDEEP 12288:kCoJR/3RMVqsUs5Uv/cLRflrj87rS6DotyeuLADu7Kle9don7j9Fo09XAyFHPL4i:poH25p5p
  • TLSH
    T142E44BB33247D9D479441B5B262A7789673DAE693F73F8E00489215A73F071A8422EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral27behavioral28
• • Target
    locales/locales/tr.pak
  • Size 357KB
  • SHA256 5df18798a35b502a18fb4f82e9b03b7ca100903ecd5d192ab2a3f0bc7646c366
  • MD5 da4c47bef469c086cdb7e5b74310304a
  • SHA1 9f0569659eb21261003a232d5d92d3aae8d47b7a
  • SHA512 55c745cd8d0aba6f4a2454c494b80eb4cc74f733771e7279b9033d52716551a85154e9eb31eebe17dce05ba71e0213e581c4b98b59a6b88aa8b9569c411e397a
  • SSDEEP 6144:GqgGhItL0rKiPxTcQXKVSIOD7rB/78GgeD58/D+iMi1AxZE9VwiBsJm7:JhIN/i5TTmUrZ7f58/5
  • TLSH
    T1FE740A8178EF382C8BB9278FD2E50626F99F0766F331E4469A169636774674703F620C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral29behavioral30
• • Target
    locales/locales/uk.pak
  • Size 605KB
  • SHA256 3fb15957c77f3635aa7cfca796b045a1ee1f1abfc0c12c163cfb537364f3c80a
  • MD5 229325584cd98c8408f7fc5c5603c6de
  • SHA1 dd31356ede30833a138fc3a6b8838cef89344a00
  • SHA512 3b57f57649877700f03aee73bc6e6e863ad65ec7c13b9851a3fc7e5d06d11ea154ce087d0a64dc689cfc55aca9eb6492154c9eb18130f6d17b8d94ac8c37a6df
  • SSDEEP 12288:c5cHmNYribnlyvk7KQ0N1nteW51B3IjNtE6TxLNiXEFqIDV2:c5cP+kT552Ef
  • TLSH
    T10BD488B19A9D58DF0105F05BE84C7A0D7DA741FE7FA6871625A43DBF28F20248A3C71A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral31behavioral32