Analysis
- max time kernel
300s - max time network
296s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
28/06/2026, 03:01
General
- Target mpclient.dll
- Size 3.7MB
- Sample260628-djd7daez6m
- SHA256 52ee5610acf2b579724f72a9e6f0a77835c1580a400ec4022e1e6a1018503bab
Score
10/10
Malware Config
Extracted
Family
-
remus_stealer
C2
-
http://khabarraja.com:4437
-
http://carogra.biz:4219
-
http://angect.xyz:7838
Signatures
- Family: Remus
Remus is a stealer written in C++.
- Detects Remus stealer 1 IoCs
- Badlisted process makes network request 14 IoCs
Network request originating from process or tool commonly abused by malware.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\mpclient.dll,#11⤵
- Badlisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2712-0-0x0000000140000000-0x000000014003B000-memory.dmp
memory/2712-1-0x00007FFD0D930000-0x00007FFD0DD04000-memory.dmp
memory/2712-2-0x0000000140000000-0x000000014003B000-memory.dmp
memory/2712-8-0x00007FFD0D930000-0x00007FFD0DD04000-memory.dmp
memory/2712-14-0x00007FFD0D930000-0x00007FFD0DD04000-memory.dmp
memory/2712-20-0x00007FFD0D930000-0x00007FFD0DD04000-memory.dmp
memory/2712-26-0x00007FFD0D930000-0x00007FFD0DD04000-memory.dmp