Extracted

• • Target
    file.exe
  • Size 328KB
  • SHA256 84b8ec2f3b29a10f88d21fc7617cdfecac1c2c76303086b41471beb5f563f65c
  • MD5 066dab36fbf44cfa930929d002a07cb3
  • SHA1 9ba5a8bf9564e71f333406b3e4962cac35e33a38
  • SHA512 bfe660c8f6b234a666896f829286006b7f42820fbbf1322f43223c39dec217d692b872218df9c004b202083c7a498c668d99b78e1bce029a58d2bf308a73e8ef
  • SSDEEP 6144:rQxVrl4fkcCYDHElcLjm+WgUqeIw5mMVDMbEwV19ohTNwyEtSo4V:UVrl4fk9YjhLjWgPw0ADMh/SkX4V
  • TLSH
    T1F064C005BB6710ECE1778978C8581662FB773E614350AB6F0360B676BF336A17C29B21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionremus_stealerpersistenceprivilege_escalationspywarestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2