Extracted

• • Target
    Installer_x64.rar
  • Size 106.2MB
  • SHA256 b295470a51231e71823a8ac5285f0425abc041fed6849519f96aeb6ecc7b8dda
  • MD5 8926eec6ac93a7b8af828a2fcd3ceddb
  • SHA1 35cc6fba9e4d2bf15631a8922779a121c50fe529
  • SHA512 75056f16258d2b2dc9f2f7d9ac8c72da6aface8cc049f0060a511f16bf0a8594d4924fba7f98d49c9500c867a631299e9795047b50a8bbfbf948ff74e66cfc72
  • SSDEEP 1572864:9dITqT8kOZIA5n0BFznqjVRgyhvFRiKGkmlO6Fz1Ogg24805RVen953goiSuDmes:9dIOT8zSFzTOjiZE6Fz1KVen95w3qe2p
  • TLSH
    T133383348B4EBB79A52DDC50EECDF87C70888A5567CC1E7B13257C80A7D6C12F4E8864A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydonutloaderremus_stealerloaderspywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2