remus_stealer | c9599c492084773544a5c8fcfa2feaf99c07a0d5fba044ad8fd2ff37e7a37dae | Triage™

Login
Reports

Overview

overview

Static

static

3

vl0сtХ/V...64.exe

windows10-2004-x64

vl0сtХ/V...64.exe

windows11-21h2-x64

vl0сtХ/l...ng.dll

windows10-2004-x64

1

vl0сtХ/l...ng.dll

windows11-21h2-x64

1

vl0сtХ/l...ng.dll

windows10-2004-x64

1

vl0сtХ/l...ng.dll

windows11-21h2-x64

1

vl0сtХ/l...ng.dll

windows10-2004-x64

1

vl0сtХ/l...ng.dll

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

Target
c9599c492084773544a5c8fcfa2feaf99c07a0d5fba044ad8fd2ff37e7a37dae
Size 3.6MB
Sample260528-bb1djaet91
SHA256 c9599c492084773544a5c8fcfa2feaf99c07a0d5fba044ad8fd2ff37e7a37dae
MD5 ebaf847c640e1c78c5e8ef55bae9ecec
SHA1 0acc501c75232489f463cc3ab82315f29e9fcfca
SHA512 98eb83327c31503fba6699f25315a6b0aa5b7d10becf5a5a949487588ee8913b159e124612dc2ab1bf22a7bcee4ba1aa47fc58fbd7f954e7daff2a511864a795
SSDEEP 98304:c+PHp7hVjQqm4gnNM+kNjoSmu5cNLffmzL/KFNA:tVVjQIgnsNjokcNLmzL/KrA
TLSH
T1B80633691DEF8DA182F3597104F97AF24E8781010606A8D0FE3CE291DD788C535EBB6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remus_stealer 2ad4091a04225a386da882560ae856af stealer

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

vl0сtХ/Vеl0сitуХ64.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

2 signatures

150 seconds

2ad4091a04225a386da882560ae856af remus_stealer stealer

Behavioral task

behavioral2

Sample

vl0сtХ/Vеl0сitуХ64.exe

Resource

win11-20260513-en

windows11-21h2-x64

2 signatures

150 seconds

2ad4091a04225a386da882560ae856af remus_stealer stealer

Behavioral task

behavioral3

Sample

vl0сtХ/locales/resources/app.asar.unpacked/node_modules/btime/binding.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

vl0сtХ/locales/resources/app.asar.unpacked/node_modules/btime/binding.dll

Resource

win11-20260513-en

windows11-21h2-x64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

vl0сtХ/locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

vl0сtХ/locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.dll

Resource

win11-20260513-en

windows11-21h2-x64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

vl0сtХ/locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.dll

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

vl0сtХ/locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.dll

Resource

win11-20260513-en

windows11-21h2-x64

0 signatures

150 seconds

Malware Config

Extracted

Family

remus_stealer

Botnet

2ad4091a04225a386da882560ae856af

C2

http://rfidassist.com:5321
http://woodfez.biz:7582
http://firewai.biz:48261

Targets

- Target
  vl0сtХ/Vеl0сitуХ64.exe
- Size 1.6MB
- SHA256 9512c1dff0ff263e565fa5a75400d29a63545c2afd0faaaf8288696691ad712d
- MD5 e42252e41df9a1bc840e673b3c3a7af5
- SHA1 1381b18b00f368eb7733112b8df34abfd714369c
- SHA512 4a36a07f9fb6b2f178127820118b3059800af13fc137534d633d17586c49cd59eed8adad9ae4b912b5dc121083f048f05919e3bd60402d7225d2c3d5d4666018
- SSDEEP 24576:vblSfBk1K8tz3QG2hGnA2fKL4+Y1p6I/NBele5yK2CxLdurbxCqc:vb4fe133QNh+3K0ZPGkdt
- TLSH
  T121854B1ABC9009FAC4A663328CB61291BB76BC4A0F3223D72E60727C2F767D49D75745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

2ad4091a04225a386da882560ae856af remus_stealer stealer
- Detects Remus stealer
- Family: Remus
  Remus is a stealer written in C++.
  stealer remus_stealer
behavioral1 behavioral2
- Target
  vl0сtХ/locales/resources/app.asar.unpacked/node_modules/btime/binding.node
- Size 118KB
- SHA256 98c51303c38dc03faeeba13f26fa3c6645d0c1a502b8a5d28177ce015dacf35f
- MD5 13a2579ed95366185a6247c9e4b9f0cc
- SHA1 61fef12da622484e44b3c9ddcd61706c9af00aa0
- SHA512 7aae5a45f5333355c81e4a7468d40c9d814a1b242c99a39747fea9b66e277dd1060bda290fc980e958beccab2ac0232fc4aba078426ac5ae39c19968ae8f58d0
- SSDEEP 1536:OMwHUFyUCyB7KdX2teZOpSPtvdO+tYLZI2mAq+J6sWyd09dlgh7tBrdO6t2:hwjUCyB7eC8OpSS+tYLZI5+NMKFdO6t
- TLSH
  T1ECC36C57B2E541BFD4768278C9930A45D3B2B82507309BDF07A4425A1F237E1AE3EB72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  vl0сtХ/locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.node
- Size 125KB
- SHA256 149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c
- MD5 eeb1d1ea9fc3f870f292161cfa79850d
- SHA1 ea4f4324245f9f4d6280ef285151f688221d6023
- SHA512 795269fba2737ca51d61bb0f6e674c8ed45f2590a48d1dbc53adae9a85b5565e372de6e2a888f038660173f6f4fe0ecda293c441415296e79097c261c452f254
- SSDEEP 3072:cd5+N3E2MosoJCakr0dHPAMMMtrAfz9MrRAG:yIxMQQakr0xPSfzirqG
- TLSH
  T1E4C35B1B73A440BBE4778179C8531A05E772B8610B71DBDF07A0429A1F637E1AE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  vl0сtХ/locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.node
- Size 118KB
- SHA256 094bfeb0692885f1e56bb363e1065099eab48a7988c8603fd6a3fb49ec88b09c
- MD5 6c12c930f974e5bc7872b58964f42359
- SHA1 805c5c899c32535d2ee8b2bc12deefe5fdaae566
- SHA512 f46c416e3f33e0526c2d4cb3df738f7c9b11fece350b90ca9613e5d86bae7a363dd20b80d62f5745a9d51773b655199537b09fcf47acf226f35002f39f1596d3
- SSDEEP 3072:/WKjx2yp1tLqA1HB4kdeRqGmX5EMMi6leGS:3xBPVf1HB4kER4UFhS
- TLSH
  T18AC35C1BB3E540BBE1768138C8671A15D372B8214B61DBAF13A4465D1F237E0AD3EF62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

2ad4091a04225a386da882560ae856afremus_stealerstealer

behavioral2

2ad4091a04225a386da882560ae856afremus_stealerstealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

© 2018-2026

Terms | Privacy