Extracted

• • Target
    RobloxApp.zip
  • Size 6.2MB
  • SHA256 6faee0358fb5e56a9dafd114c32f98b961968a1102aa20372dc2f16482fe73c1
  • MD5 09fca3b11a959194ac6dda33f9e01d0d
  • SHA1 8cf1ee7885229e8e50deb7ac305eef8256bf4582
  • SHA512 db7d0a991c96dc85e421b8c37e3d0513618e17220ce8d4a8df5827a1db234157f036f9f769128821be5be7a85af25023d48b3e72c43b5a96cd7c2b800fd7b98a
  • SSDEEP 98304:tz/90lTghFn4D0+dSRb27yKzKiSiMz+OGQC4dxBK1hUCAQl7xJAqyNu3eVqUmyAi:VWghFn4o+MRI2ilOGQ3dHpxHdmtdK8St
  • TLSH
    T1E1663355D6DF2AC0AF05C8E56EE1E680CC11051B44C9F7DD6C7ACAC2ADEA7ADB087321
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Bootsехеc=64.exe
  • Size 894.1MB
  • SHA256 092167a4ee19c3ef32d8657cd0b467f16a65bd38fdffc63821619782ba81f296
  • MD5 f7d3bafa96021aeac8c4db6dcc720baf
  • SHA1 b80c6fba7115f885551b450955ce4235c7d827d3
  • SHA512 f285fcaade6177ac1897458add800357e3e1f56c5071d1ecfde59af6eb27dab6eaa1d91d0dee3911892c4fe611a1cfd9583e376f02ba22da025619d1382c477a
  • SSDEEP 49152:B/QvbQIXe2I1D0PzzgfokFs6vG58XdFjkIVmWhA05GJRO9a/ND7YksO+Tr+upG9C:BG5qOy3mWhB5
  • TLSH
    T1BFA94917AE9148FAC599E731C8B74215BA74B80D4B3123D32EA1BEB82F327C15E35B54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral3behavioral4
• • Target
    locales/hi.pak
  • Size 787KB
  • SHA256 eda355e3785313e3d982c1d3652266dce1b6e08832056fe58854b825e0712ca5
  • MD5 1185163466551aacae45329c93e92a91
  • SHA1 0dcbfed274934991966ce666d6d941cfe8366323
  • SHA512 6fad3e24eb868acf78db0591c7ba77abc84e92cda28e8bffee435ea89940a8607e7628c6c5159349377a8d933f373db2dfa4e5715ca404bc3e67fd4a0f22a606
  • SSDEEP 3072:4m//Yxz8BS65Ob5EeQzFc67R7dk5Sv34QAEm5dmLrsoe4GR3doInN8edYbOqGPt5:rYZ895O9ExFlReg5R5HQO4
  • TLSH
    T11805180CEBBEF3B55DEC3C8A32890D37D59D3674A3E9521348D5B3DB9844CB4146A2A2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral5behavioral6
• • Target
    locales/locales/af.pak
  • Size 327KB
  • SHA256 b1987cdcbb8d76598422aa1739a246ed6690dc1b211f950fcbf2f040491ed7a8
  • MD5 c9312ff081e600e5fb4483b46ddd7c23
  • SHA1 1ff05a6a06cc73caf2d7545a3821d90c228ac0af
  • SHA512 20c136b44770aa0e06259687656675a3e14310ea4e8ba214726b216bc1bcad6026267bf0132cbca642c0b5c49293386d0a1bd93ba40e1c33b648ae70416e8898
  • SSDEEP 6144:ZP+kgc+kVWlEvC9Z5D49Em7kLjB6oAYxjYgDbwxesB+xSK1IA3y25tHwDwv22iGe:ZPfclEvC2im4LjB6oAYxjYgDbwAVSK16
  • TLSH
    T170641B0ADB80273D05E07696FA0445F7BB9CB26DD770B2BADD9981321962EFC01BD1D8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral7behavioral8
• • Target
    locales/locales/sk.pak
  • Size 383KB
  • SHA256 dbd82a2a08f8e9ba9581b2672bc49e0fa5c89f073b58f152225f9e2815228ddf
  • MD5 989d000fbe286c0fd4bfb35305b52f48
  • SHA1 5a30a2cc1abe9977b1ffc4c4712452e6d55bc7df
  • SHA512 ed57c66237d5226d4d5cb63e98248c0df9d381ef86b6d4ef339523f430c54aab14f84121e05e9fedaf273323ec04b8a539c0aeb791245858890126de2ce38283
  • SSDEEP 6144:HX/6WrhCQ+koL+vMFVxyXiFJ7VC35hJYLjaQ3yGLBGR:HX/6Wr8Q2hnxyXiHVO5hJYLjaQ3yGL2
  • TLSH
    T1BD845E3FCFE61C1E8E990108DEF57210F9BE4690864DA4A6D44F328724E37DD9AB8D49
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral10behavioral9
• • Target
    locales/locales/sl.pak
  • Size 369KB
  • SHA256 d0415bfa061b36a6eb93fa2c78563448da8b63c91e0523086c7eb2714933ab99
  • MD5 234e628a62f822bd7b3546b91e79cab2
  • SHA1 10f48382495bdbfa3b30c15b91768817df13d828
  • SHA512 51234fc3fb5199a3a86dcb7ca68d3c471f1b97897b1a9f90139cfff9846a6c6fd039a0c817e7611e0e59637746cc51045f6ce493cd6f2d4e144fec1c6a561456
  • SSDEEP 6144:mK8+KqhWYynnbANj7nHZiGm4ocyxPbPDZFu+Hr7ftjQLm55gdrcKx6EIbi/fzMNS:z8+awi91L55Arc7EMi/fzMiqg
  • TLSH
    T1EB842B35ABA75E0E0DAA66CBFDB203017BDC048CD641D6A6FC4F33695012B2827BD599
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral11behavioral12
• • Target
    locales/locales/sr.pak
  • Size 572KB
  • SHA256 d459c1a781ddc344de76558211983dd07d47e3ca6cacffb518043bd78dc48fbe
  • MD5 aa4e2e54b648f66794f485318651b730
  • SHA1 18c1d5badcc5c05dfcf9e68df66f53c69e33e0ab
  • SHA512 cda7b189f48f28463d045174f3641f16737288b159adcf41da0c131a05a396a40e562b2f0aa10b08d323290f19d864755f238b074a698efa3c573d2b5512948d
  • SSDEEP 12288:AqOufVklJRr1HI/Y11PPeHyxsYQf5uaxbbNK6374Xzt/k/t:AVIkh3HNcf53xnZ
  • TLSH
    T1EDC457B19B9E64DB0501F41BD808BE493DAF41FE3FAB975611201DBD34E20B847B929E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral13behavioral14
• • Target
    locales/locales/sv.pak
  • Size 334KB
  • SHA256 3f0acf6f6319636c3e72cdc392b7b80ab0cfd8ae1a5a8e319624e4b46bcd3c42
  • MD5 c5437bb175fed93e85c5e7caf76ff352
  • SHA1 0d74f7df049ea73a47fe93b75c98e356b9bdd4b7
  • SHA512 00af14e7d89a12f4f39fb45a3f9c136e20c06752f98fdedbad426ac9a5b820260a329059659cd82fd089ab1d94c1f51ab4202fb6b142b27538d0139e67877239
  • SSDEEP 6144:UIcs6Ou/WpIjSwjcT+BjxEEkb/LX6uTSOoDE/xUDSS35655egbH:It/vjtBok5U5h
  • TLSH
    T1D5743B428A20F536FBB2170DB904115F4ADDE15CE7E2848E78D9883DAE87D9845FF24B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral15behavioral16
• • Target
    locales/locales/sw.pak
  • Size 351KB
  • SHA256 dea6947693fceb6457801d912ea7c716add3c0cfb4c34782a9cfa4c4e06b9402
  • MD5 e37fc1c3dce484bd0ce496f548f14a43
  • SHA1 02b088a11363b0a4c0527053669af32737f1403b
  • SHA512 c5c39d54f4eb6b0659903ce9b5c8804a750a254bf88cc7c6e729e7813ecbbcc88df882af9294b5b795ef5b8afe8f1a60fcb46b3929a9b2cdf41c84188e5852b2
  • SSDEEP 6144:HhUmBklgBZcaZwoRdkN6Csdq0rnKKcLLK+9s35FSaDN+q5CwAyeKnHwQ0/:mplGCkp9KhHW35gyCHyG
  • TLSH
    T1E974E76288B1D0195733518603D8FF7317DCED9C292B28A35A46BF4F218F98C57ABE49
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral17behavioral18
• • Target
    locales/locales/ta.pak
  • Size 899KB
  • SHA256 e0421b4cf2736bb465ec02cd85c2df09809f86479cb7624195373f25edbcedd3
  • MD5 5002d84bffb908a2dcc7e1b69836c265
  • SHA1 4cbbe387a6744aa6c51b15b5a3a223135a3f6115
  • SHA512 c2a4a46a27304eb080b066f049d2eae733470dbf0f8107220049eaefdd73fd8b41abd1b02b4a2ee6934b4cae18de97bca5360022a8e295427a0bd63603bec410
  • SSDEEP 1536:gozNJu8JvUHZZvrdAYWSXR1q+y5fNU1prH+O8ep3EvFZRj2IpewYxg3ZHa4dpeJT:gsNJvUXdWSXRUlUj9yw5fG7zWtRjcA2S
  • TLSH
    T159151CCE923EEE890F93288F0319536912996155C07BE3A27C756E1298ECC5DDF3427E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  executionpersistence
  behavioral19behavioral20
• • Target
    locales/locales/te.pak
  • Size 836KB
  • SHA256 f53e06181c9fa0f6028906a7388fd4e8f000ffb7277330634462433d34572395
  • MD5 b1a4d471fd8af54dfb8ff252246bfde1
  • SHA1 2044ee38f8d8d76176a735e726de189feac14985
  • SHA512 18248d3fa8f4cc409788d28a244889230b074fff416ba5998f25f3b67ad0c627172a5e7e3947e61e72ce28a5b4cb2134d6627b6252b3d282b54f84b424136c87
  • SSDEEP 12288:VluBe3p1F9fBiTlbUYgiNFOSdrUH4GrQKZkC28+5HX0Dkq9GyAdsoAkhodSMtS6f:VlUh4D5nM2
  • TLSH
    T14B0592023A6AD310DAE70273752CF66C49681B8161D6732C1EAFA357FB87D7E0843676
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral21behavioral22
• • Target
    locales/locales/th.pak
  • Size 704KB
  • SHA256 4fe2b7b6886e3ce068be0b7a0a71d45756eb797eda1e7d4fad52ab8a370e8336
  • MD5 85f59bf2f1167e34ab2b666608805420
  • SHA1 f0d8e8fc644c15c52c5f9d3419f88e6072799736
  • SHA512 86d6061895c996ad1caa3f3871c014b656e7ba7bb91f05c72a591cb5877c3db61965bc1a5094dcf7c4127d11f8106622355464704fd0695372627d8400a16ddd
  • SSDEEP 12288:kCoJR/3RMVqsUs5Uv/cLRflrj87rS6DotyeuLADu7Kle9don7j9Fo09XAyFHPL4i:poH25p5p
  • TLSH
    T142E44BB33247D9D479441B5B262A7789673DAE693F73F8E00489215A73F071A8422EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral23behavioral24
• • Target
    locales/locales/tr.pak
  • Size 357KB
  • SHA256 5df18798a35b502a18fb4f82e9b03b7ca100903ecd5d192ab2a3f0bc7646c366
  • MD5 da4c47bef469c086cdb7e5b74310304a
  • SHA1 9f0569659eb21261003a232d5d92d3aae8d47b7a
  • SHA512 55c745cd8d0aba6f4a2454c494b80eb4cc74f733771e7279b9033d52716551a85154e9eb31eebe17dce05ba71e0213e581c4b98b59a6b88aa8b9569c411e397a
  • SSDEEP 6144:GqgGhItL0rKiPxTcQXKVSIOD7rB/78GgeD58/D+iMi1AxZE9VwiBsJm7:JhIN/i5TTmUrZ7f58/5
  • TLSH
    T1FE740A8178EF382C8BB9278FD2E50626F99F0766F331E4469A169636774674703F620C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral25behavioral26
• • Target
    locales/locales/uk.pak
  • Size 605KB
  • SHA256 3fb15957c77f3635aa7cfca796b045a1ee1f1abfc0c12c163cfb537364f3c80a
  • MD5 229325584cd98c8408f7fc5c5603c6de
  • SHA1 dd31356ede30833a138fc3a6b8838cef89344a00
  • SHA512 3b57f57649877700f03aee73bc6e6e863ad65ec7c13b9851a3fc7e5d06d11ea154ce087d0a64dc689cfc55aca9eb6492154c9eb18130f6d17b8d94ac8c37a6df
  • SSDEEP 12288:c5cHmNYribnlyvk7KQ0N1nteW51B3IjNtE6TxLNiXEFqIDV2:c5cP+kT552Ef
  • TLSH
    T10BD488B19A9D58DF0105F05BE84C7A0D7DA741FE7FA6871625A43DBF28F20248A3C71A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral27behavioral28
• • Target
    locales/locales/ur.pak
  • Size 532KB
  • SHA256 06a0c18d978b54dd163c7f77b7ee0f2ecf3607c5dc14032326f21b4a1f304d81
  • MD5 6310a289e55b1022f12b4f3cc29fe831
  • SHA1 150d81ec8db4d9aec6c0e83e5577dcb7f1956b38
  • SHA512 acb538fce25486e6a01401aa0e9204a6f519cd1dfbca48663d6142e1fb6280bab271dfd2b4c5ddc858de6920805e539b791c48eddcad124d0aae298d479dcf48
  • SSDEEP 12288:K6Du8PzOYzXPyn+jAcMR5RQEA2WzRbQYrkuvco/9NjjFpvUu:cYiD59WZ
  • TLSH
    T115C410D1E6BC92B25A21D92780E33C34CB635F13D34BF286E56106C54E9A1136F6DE3A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral29behavioral30
• • Target
    locales/locales/vi.pak
  • Size 424KB
  • SHA256 f1602637e7f3e0a908d7a9a3f630b8dd38bfd26704cc64ef432d2c88a1ee7017
  • MD5 1b1b14f542bb4a9f014d1801fb2e4007
  • SHA1 0f56c35b2515fc92690126c54d57aa763a5c3288
  • SHA512 3e98c44ad74d905fee06851eab16576f6261a15336f1c1f625f646af725988b75957ed89c16876ec6127150e2b28778a5b65f897b9540ad1e4cec98be705cde7
  • SSDEEP 12288:PJnzrvsPgnzj0VyK1wSMTgG9lt5uEHziW+UH6JziV1ZH:xnzTsPgnzj0VySwSG1n5/TiW+UaliV1N
  • TLSH
    T1A094861216E0702680AC553EC5CE540E6FCAE42FF7808FE57FE4297576221A56F21BAF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral31behavioral32