Extracted

• • Target
    r843.exe
  • Size 424KB
  • SHA256 246717653bc2ae2e09036bac56c9d79940c652972a73f4c6aa9b925c28cce095
  • MD5 f12f406b95c0d82ecc2bebef6f2b343e
  • SHA1 908ec018645315239dbd8b941f3e55a44d4b9811
  • SHA512 0d1433a2a6c9808a7abce8cf3fab07e8aa15b0a4487d4220e6daf6b5a694bd476eee0dfac6f09ecb4bbe63388dae766505a71b04548d0e9372967f7dc43be437
  • SSDEEP 6144:Q4LVrlG7iqk0J3CTahZKQW2aqe68t2TfqF1wHsC7gDQzOkWbsf2iDXmmhPzl:/VrlG7iV0pDh/W2b8iEwH17HzOkWibm
  • TLSH
    T136944804A659B4E8D16645F784C1371DAA26FE0032C05EDA3ADFB6716E327E0EDDBE10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionremus_stealerpersistenceprivilege_escalationspywarestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence
  behavioral1behavioral2