Extracted

• • Target
    file.7z
  • Size 20.4MB
  • SHA256 48cd456c451d1a299af9ffd665cecd49251ae496da271b77f08c21a1995cd80e
  • MD5 b1171b5a4d975310d55f6e0927b74196
  • SHA1 f99dc3287fe9d633164f44ff237cd8b52c5690a0
  • SHA512 fd3cf176faa238fc231be7e27d389b9737825ac9360f5e7b19e51c25c0b66ce45b4fb76bd9beb42c01407d255ce3b7a557a523894c46ad4166db3248e129af09
  • SSDEEP 393216:f+85zuHoJ4NpOaAMaJFiL3lUVUzBZMGvmW3dCJJIx+QrJgvFBYMrU9Vzr:VGNAfM53eSHMGBIMJgfYMrU9N
  • TLSH
    T13927337D1F6050EC0449E8DE74B83819851355AB6E31A9E5EC2C0815BAAB1FF27B2F73
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2
• • Target
    appFile.exe
  • Size 831.9MB
  • SHA256 34a9116bf497fea382f1ac2fb41cbdc14f6a6f3bc70d2fbb04afd4a2abe54017
  • MD5 97f991b0f463d0dcc7c229ea887f2cbf
  • SHA1 076c3f69e7ceab0894558224c410325839a9c1fe
  • SHA512 35b6209688bbe4fda8c394630f0d5c9d70a74cd16970d079332f143ff7c3d4fb103b0ff3d7edf33224385ff507dbacfb7364eb01d2ebbc9ad637a44cbf505da1
  • SSDEEP 393216:cWFU9moRaHQ4Nsn2uYy2g7JKTqhluBx71S5Nxub8kK/rVhpe2A+2SZfiHn1E5doZ:cWFToRaHQis2tqhluGrubou6RiJreS
  • TLSH
    T1E499BF02B7F80065F1B7973489B79A12EA36BC611B31D3DF1290A66D1E737C09E35B26
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealer

  • Detects Remus stealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware
  behavioral3behavioral4