Extracted

• • Target
    TFT Unlock Tool 2026.rar
  • Size 19.3MB
  • SHA256 d8d006a48a641e4581889c47467a5345419f93e6f6f2cc355154692377ac9dbf
  • MD5 7f5405643e4d9f16a25e70b55fb488dc
  • SHA1 019c368609799285cffd4ac5d62efe1b4b9df005
  • SHA512 834982efcc472beb07f22093f77421417e58d6892f0f092e356211ed658caab65ee83738782df09a249f053d6c161cdb8f94bef8cc553161b888655a0a155be7
  • SSDEEP 393216:a7WKAoz4Y4SUbp3XeqDKRAScbkeg7B0pYg7kVR5vlqkEVFC0RzwN:a7lAoz4KOp3pg7Fg7y59cVJUN
  • TLSH
    T1A017339C62F9EE5943302CA415B0FCF185251F8FC7326AB6B366785DF5E92897B108B0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionremus_stealerpersistenceprivilege_escalationransomwarestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Suspicious use of SetThreadContext

  behavioral1