remus_stealer | 139d50b674112ca42a6f9e2aea789d0a1f3bd64e7ed5584d54bbfa6c7a418f72

Analysis

user interaction
yes
max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mod_Pack_x64/Mod Menu.exe
Size 2.6MB
Sample260626-pys5mact3p
SHA256 139d50b674112ca42a6f9e2aea789d0a1f3bd64e7ed5584d54bbfa6c7a418f72
MD5 787d7a0b27f676de5986ff2aeffa694d
SHA1 41f8ffacbe031d1db7828d62a8e3a868f8599342
SHA512 51b8d799dbf45772b89c4aaf8b6e69a9c3ef27aad5a070f55330f3a5c804b8f512ebc1ce5e58c73194830c98d4591b09a715971850009bbe726b27351d924036
SSDEEP 24576:uPZtM8OLgPobE1yqIEpeuJ2IvDzgct5Kc29JaAh7Ylv1+Vfxz6vA2Bele5rKDXQe:uBWvL4oFEYuJ7vJr0JRwefFQYa/9o
TLSH
T1BAC54A07BD9148E9C09AA33189B7529A7B75BC480F3227D72E90BB782F727D05C35B64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery remus_stealer spyware stealer

Malware Config

Extracted

Family

remus_stealer

http://kereta-tinted.com:8893
http://carogra.biz:4219
http://myrtler.biz:9549

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Detects Remus stealer 1 IoCs

resource	yara_rule
behavioral2/memory/5964-1-0x0000000140000000-0x000000014003B000-memory.dmp	family_remus_stealer

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5964	Mod Menu.exe
5964	Mod Menu.exe
5964	Mod Menu.exe
5964	Mod Menu.exe
5964	Mod Menu.exe
5964	Mod Menu.exe

C:\Users\Admin\AppData\Local\Temp\Mod_Pack_x64\Mod Menu.exe
"C:\Users\Admin\AppData\Local\Temp\Mod_Pack_x64\Mod Menu.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5964-0-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/5964-1-0x0000000140000000-0x000000014003B000-memory.dmp

Download