Extracted

• • Target
    PC_Cleaner_setup.exe
  • Size 4.1MB
  • SHA256 42ff13593789df2270a7ff8be221c0e2dbf6e0fc777a143cf9a9d42fa049a61b
  • MD5 17445af51031ffc5a7eb10a1d411d586
  • SHA1 5e3cc4d9cb9b3152fb225260c89576a9ef83b42e
  • SHA512 9ea3ff20d4c7eda9bec093ac8bd6af3d5e7e183043d5b2eb5af06069ec23af5aad8e9176c6a8f8402ca1ed7ff88fff14cd2a562528d54104aec3ae390464f87b
  • SSDEEP 98304:D8rJUzu5TjafenPUYiQGho1ObPnlliWCfpNVl:gKZ9mW3bPKW4V
  • TLSH
    T11B16E088F636548CC08112F2932AB639D6BCBDE285C415DB1DAD3F32D532D2BDD462B6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryremus_stealerlinkpdfspywarestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2