Analysis
- max time kernel
28s - max time network
30s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
05/07/2026, 17:02
General
- Target mpclient.dll
- Size 2.7MB
- Sample260705-vkdexad19v
- SHA256 101cca11ddad5036ce8675a024e763f1123fda5ebcc063145c2bff4cda990ef9
Score
10/10
Malware Config
Extracted
Family
-
remus_stealer
C2
-
http://1printers.com:4959
-
http://carogra.biz:4219
-
http://angect.xyz:7838
Signatures
- Family: Remus
Remus is a stealer written in C++.
- Detects Remus stealer 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\mpclient.dll,#11⤵
- Badlisted process makes network request
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2192-0-0x0000000140000000-0x000000014003A000-memory.dmp
memory/2192-2-0x0000000140000000-0x000000014003A000-memory.dmp
memory/2192-1-0x00007FFFE7160000-0x00007FFFE7437000-memory.dmp