Extracted

• • Target
    r843.exe
  • Size 287KB
  • SHA256 4f92f1b658856b2662100c26dcd5f81525a74482b4fdebb16923ec27234f0a7e
  • MD5 656520f8a060f84253be72512beb3406
  • SHA1 4f3025e6b0053f462021519805a49eba5c019c91
  • SHA512 aad1ba930500ea578dd84febc8ce05d841d3c23ea72e276b74e9dc5d5ddd7f690ad386c77c22e5e3d27a19dbb691ce8f3e8fc674265edf75dbd34b5707737ac7
  • SSDEEP 6144:jknVrlmji8AypzUBAzL2oWAEqekzOqS0XmTUmpwnpD59+5NYAW:WVrlmjivy9VzRWAjaqhXmrINU5NYv
  • TLSH
    T10E54CF05F7AA50ECE1778474C9554A62FB763E5643809B2F0360C772BF136A0BE29F61
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionremus_stealerpersistenceprivilege_escalationspywarestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2