Extracted

• • Target
    𝐒𝐄𝐓𝐔𝐏.exe
  • Size 5.7MB
  • SHA256 2ecf04b3f001039184d841dd067d6e47bf192047ffe6b92c72a9d57bda6c6afe
  • MD5 4ffeee5993c69e77a2553981ee2f9ea0
  • SHA1 b149646eae65f70490466a0b196f659a192f8e8b
  • SHA512 f86ee0a877cf103892d5997460d1fdf03b5b619c73d09cb88f6983b741903c691f980bc04fdb511a3bc8c0c9671eb32be219cd84e47f2c9f58dbea55625ca2b3
  • SSDEEP 49152:2uOVA6kgGE2C8rb/TTvO90d7HjmAFd4A64nsfJPsuLplRcJ0HjEUbP0geMtD3q3c:XgGEhUS3q3DvY
  • TLSH
    T1BC564A17FD6510A5C5EAD630C5764212BA30BC894B3433E32FA2BAB82F767D05EB9744
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwareremus_stealerspywarestealerdiscovery

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2