Extracted

• • Target
    d9d6fc3085dd822f258601164ecb21f318822a63ca0360aead9201bcee49ed04
  • Size 243KB
  • SHA256 d9d6fc3085dd822f258601164ecb21f318822a63ca0360aead9201bcee49ed04
  • MD5 4b3c6ee4490da28af2ec40637384c400
  • SHA1 96f4bf9096686fcb2cd171034b9ea22cd4da2280
  • SHA512 738cd449977611e801798c10bffb44bb3a38c68f92b7c112ac9af3f8f8930fd9fe00ac2d45592b68788ff02fce9f95ba3f7e6e1faf61d11a5cfb25349c467d56
  • SSDEEP 3072:4/sQH9nTmUMzavkcHrU2DYgdbIX5US94NpVq8BxFRzaqF+o2GQJ7/JzqVfGv1:49TsgYUbcdgVqwlL
  • TLSH
    T1F134086E9E97A641C5160836B87353814B799E7964CFB5628EE33FFE4BF3C9810070A1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionremus_stealerpersistenceprivilege_escalationstealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2