Extracted

• • Target
    r843.exe
  • Size 291KB
  • SHA256 066d83b98a2081e0bb075c94376aebc9b0fd6499025cab1762d83bbb4d7576c6
  • MD5 5f48794510a5a3418cf042d95ffa13e3
  • SHA1 3b02d3ca024359776843cdd420e2a7decbb6da35
  • SHA512 1dc92b50ee84ee32ed0e1d0858ad837d1ed0a1b00c125f77718967a4075341f8f4cae76e0aa22879624d3aa52b327d47cd907440877620dba5fd39fa1c07f5f3
  • SSDEEP 6144:1qNVrlmzES8opj+t89VU8We6qeDdvrlx/9GvzfuM1AbcjmgP8Z:UVrlmzERodn9tWeMrlx/9Gvzf71AbZg
  • TLSH
    T1CC54BE05F7A750FCE17789B4C9120662FB773E164350AB2F0361CA76BF126A0BD29B61
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionremus_stealerpersistenceprivilege_escalationspywarestealer

  • Family: Remus

    Remus is a stealer written in C++.

    stealerremus_stealer

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2