Extracted

• • Target
    file.exe
  • Size 4.1MB
  • SHA256 f02eb5040f50f5bdade4c2a2114ec43c33bdf4a7fd9051f9f7d411eb50b1474e
  • MD5 fdb6448a3ac57e511a53cda07945be8f
  • SHA1 35170d38f2089910e6dc71ea9a2fd202f6dd2736
  • SHA512 a51ad5a2c4b57becaac22cd301025dfbc74d4c74fe1b883002eadbcabe68d3b2e3f33a22daef2cb1c9ebcc84d43e18fd4c68622b1d3e476f614e8373099892c3
  • SSDEEP 98304:/b3osRj07odi0u2/r28ooycdvb5aRaFeGzTl7ez2Il:7DkoVuwravcOgFegyiIl
  • TLSH
    T1BB163338BEC257A7E71172BC7D9D1984DEE35CC1138B8A462A4F40885F69FCA47432A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryremus_stealerspywarestealerthemidatrojan

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral1behavioral2