Extracted

Extracted

• • Target
    Setup.exe
  • Size 13.5MB
  • SHA256 cd184c565ca09fec7cff3b81ad241f989c2f19dee16cb9ba3e75b965b5bd9ca8
  • MD5 896a63d7f80ae784a6848e2b1aa22c1c
  • SHA1 5fe8349c463afea65f99ee8e0801aa1dfc8a7f36
  • SHA512 7760ad9824d2b99bc052541a66e79b64016dcbff83eb4c1eaa832c4e579329869eee4b8d3f4762132ff00548a3fa083677263aa192eb83ccc19689abd782729e
  • SSDEEP 393216:V0xaXYniCLJEcZhuCtTX2FL9pch2X7woRV7R:VzXKB1nZTX2FL9pk2XVb
  • TLSH
    T171E63328AB5431BAF8769378CFB3CAD6DE60780543A255EA1BD0715F0EA71C4CE27712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionremus_stealerstealerspyware

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2behavioral3behavioral4