Extracted

• • Target
    bhatta.exe
  • Size 2.2MB
  • SHA256 af12a273133b646805713254ad2012c5708be375c9dd1a3b11b3c2dd5811bc8c
  • MD5 32461b374a9f068001d31b3f5d5f3694
  • SHA1 4f2b0c68128a6f79c4e32ee758cb9f5843fd39be
  • SHA512 df42767d2c6e3a8bd369b6c316369679e84656c379bd94cafce7930ed4ad77b5d90eaaa36e187f1cfab1f89daaf66bf2528d4762dd424102ca779986ae549a99
  • SSDEEP 24576:3JIXwR0GHkRNnnj62Dxpveb0EzNX55d2TCnJ8GFDLbp0/:iAR0GHMn17veb0gNJrdnbI
  • TLSH
    T10EB57B07BCA404A9D4AA933A89B74691B675FC048F3A33DB7E50F6782F317D15A38B50
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryremus_stealerspywarestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2