Extracted

• • Target
    file.exe
  • Size 3.2MB
  • SHA256 a05e2a5c5b4b93447ad06a728f9e41ce9c65d876c87daa59ae2d8ead067d2192
  • MD5 f62ce2042c61e211449cc1d1cc3fca94
  • SHA1 3e7002d2684c7de7207056c12a7bb5e47fa40f28
  • SHA512 c7d5fdfecf21cc26958c026f02f6cc0cfc201a1e001e0edbbf214c17ed599aba0540939131e1726343c7fb9f66a75f88bc5f796f4affc13cb2dcf1b81c1919d2
  • SSDEEP 98304:Kgx67lqKLbbIsaJ8JzfVl/svOUKMwxiaq9ggP:07lFUp8JzNpsvODM1asP
  • TLSH
    T1B0F5332B77813BC6EC9D01B546C96126A4A1B4ED6AC5F3E437CBC8E54F4B34122F23A5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryremus_stealerspywarestealerthemidatrojan

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral1behavioral2