remus_stealer | f77341283eebe65482468e063179b239dbc7c4ded271a602ac5d73b6efd58b32

Resubmissions

09/07/2026, 01:40

260709-b3wvesct4s10

09/07/2026, 01:35

260709-bzpa6sbt3r10

Sharing

Copy URL Twitter E-mail

General

Target
Comprobante_Actualizacion.zip
Size 24.7MB
Sample260709-b3wvesct4s
SHA256 f77341283eebe65482468e063179b239dbc7c4ded271a602ac5d73b6efd58b32
MD5 0da3231e3bca2e99313bab29d4981187
SHA1 b20c03af58d1cbf9b1b3f8381734a97e8aaa3a9f
SHA512 1a101ea23cb4e76b45b8af14052a8f1c0fb7a1b178179d0ed31e4259d6cec1152641aa582ec0fee0ae8bb1607da3b7bd8201362addbcc38a981f0f7675503f17
SSDEEP 786432:4XhOGY8wd/Go4JjQLTk6OCeKZe/Xz0Czu1QHMK9:U+XGzOLTk6SKZe/XznYQsK9
TLSH
T1264733B479FCFA4C7A84B781304A28EBFA5F6D37D5B502DA5E48489046D171EF30E298
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Comprobante_Actualizacion.zip
- Size 24.7MB
- SHA256 f77341283eebe65482468e063179b239dbc7c4ded271a602ac5d73b6efd58b32
- MD5 0da3231e3bca2e99313bab29d4981187
- SHA1 b20c03af58d1cbf9b1b3f8381734a97e8aaa3a9f
- SHA512 1a101ea23cb4e76b45b8af14052a8f1c0fb7a1b178179d0ed31e4259d6cec1152641aa582ec0fee0ae8bb1607da3b7bd8201362addbcc38a981f0f7675503f17
- SSDEEP 786432:4XhOGY8wd/Go4JjQLTk6OCeKZe/Xz0Czu1QHMK9:U+XGzOLTk6SKZe/XznYQsK9
- TLSH
  T1264733B479FCFA4C7A84B781304A28EBFA5F6D37D5B502DA5E48489046D171EF30E298
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Comprobante_Actualizacion/CChromaEditorLibrary64.dll
- Size 395KB
- SHA256 7259de8eb1df8925264c5776418d8fb2b692d94e5c014baeab76317f80fe9738
- MD5 a196590029a6b1d3a1913c863fcfc856
- SHA1 10f61e77c16291299cd3d6de2f3716bb58d31a53
- SHA512 5e874acf359a1143a44b7adff85705b3ec38d62ae9b5a19fc959e618d9fa6c0294acc5cb6ce1f23d8ef72f6320c239146cb3465c3e4a51facd5002231650887d
- SSDEEP 12288:VYkeVe8cY2Obp+9auYRhEedKvL4soGB3Zl6ucJm:VYkeVe8cYZbpaauYA2KvL4soGB3Zl6uD
- TLSH
  T148845C0FD55808B8C5AB91BC46BB8D87DB3E758D034186DF17A886693E67FE2073A710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Comprobante_Actualizacion/D3D12Core.dll
- Size 4.5MB
- SHA256 b9411b947efd15389a28c08fcd86a42b1533f3c7abe251a3e3730191bd17c8c1
- MD5 409ddc1cd7ac97f4446b7ef3392b7ecb
- SHA1 f0853f28351e0c17a4ce12c4183d275b3625a215
- SHA512 31478e3c7c56e4b6b9879782c2c94c2e190e2ed3debb2a76a68380b2f7bf5e55da46dacf881872038998386214b480663fa11d384c6a2a24a05911a9680e5569
- SSDEEP 49152:oh38HT1tnrx7KGN6McyBTwbreXHYTNeZQROL+qgGVO9EflU7slMWr+IGrh4TeeYP:WMBxrfwNFrfau5e/
- TLSH
  T1C7267C07BBA840E8D4A6C179CA6B461FE7B278654370E7CB169083995F73BE1193F324
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Comprobante_Actualizacion/EOSSDK-Win64-Shipping.dll
- Size 18.5MB
- SHA256 f1426bed9428f0d825dc03ce4e81dff29f717679c80ebe0492fbb517c46c3608
- MD5 c8ff507f1df5b892165886d4c63a415c
- SHA1 de1cd2c04510568f88f8cae1288f16d06a3c9447
- SHA512 e22f4998976c4476cc0984c62e4db5a2e86d1c48634441c6c17f93d15144afede63218997bcad64ce546e27408635561aa5b8ca6b5d4ed26851718f6cd2c549f
- SSDEEP 196608:b5zzEWVpniYYZ9zaXMb3Kg4rktw6buh0bO:NzSYYZ9zaXMbh4gt20y
- TLSH
  T1DF17494272F40094D4BAC2BD8E67D912DB71399A0B35E6CF06A0999A1F77FF059BE310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  Comprobante_Actualizacion/GfxPluginDLSSNative.dll
- Size 66KB
- SHA256 4b801fe2d2719f25470222b13332d3aceeef8cd2406c6b5de8bbb3d88e410643
- MD5 9b07e960bf455d8f5f5ccc5f42155ee8
- SHA1 4a0814d305086a6eb1c8a3b58fdbaa5844e5599e
- SHA512 dfe7abd7e10de4724895ec4ae9c303de021f0f99ba46c06bca584f3a7d103b36be857f4527c2be47f4995d8348ff8a689659e5c811e11086d92dc45236346494
- SSDEEP 1536:z8ExWhl4mqOJlQ/eIR9mgQsYCbuevVeS9PfIn8H:AEcnTFJlQ/eOXPb+8
- TLSH
  T15E63AF4E97A800C5D6D7A134EC726A6BE2B5F9912361CADF13B1C2461F837D2A33D706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Comprobante_Actualizacion/GfxPluginNVIDIAReflex.dll
- Size 52KB
- SHA256 8fa45c63dc03315722b5cecfc9c9d7d1c668599ad87cdfd53f52dbba4898b1df
- MD5 8de3d28172c337e5fdb03bb5f6a976ff
- SHA1 4f74b06f27bb1e892f48dd9897799b9a2488db55
- SHA512 5171e7169dc4a091fa55983fbf7daa4723648e5fc61d454d11960444159f6de5dbfc7bfd4dfa7592bd8217e698ee73873d5d185a6237d154f8fe429206b6e9f1
- SSDEEP 768:jxFGm2wHp7jvzLxzUpYZLv2fIPLtnlrkB2N6fmvVnegc2Ip4jbxf1mlys8H:jLHzLWOZbsIPLI0AfmvVeS9JfIn8H
- TLSH
  T1C6339D8A97641199E677D178D8B09F4BE2B4F6521710A7CF03B0C2A61BA3FC5A33D790
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Comprobante_Actualizacion/ace.dll
- Size 436KB
- SHA256 aeaa31d7a338183eb666e7caeb82e059adf61574f91d6c1df65bc85024e701ba
- MD5 11ebc20ddac767156fbcfa4ea38482b2
- SHA1 24c4fa6d921b00f875099e8de9230efab246e4db
- SHA512 3a4e01a107fe6fbedf991cafa87970843fd92ad9b28579a35c77db4763631716be646ac3081973aadf90d41603be5cd48fcd48d0f3932cbefcb114b331f28718
- SSDEEP 12288:OHw/a5KZWJrFrpHNGeCXuxKnIQ1WUqWW:M0aTx2L1WUhW
- TLSH
  T127947D43FA41E0B7C08F4271F42DE77CCB22970B4B2586E757AA9D985E783901E13A6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  Comprobante_Actualizacion/ace_x64.dll
- Size 612KB
- SHA256 5e596a5ac72b8b4cec5d8fa555dc3e31a6dbe2b29b04c4d3077f19743350ecb0
- MD5 499d6028ffb35f2dd3c392ec42023b83
- SHA1 6c4661210262056274afadd8aeeff9aa46f3d943
- SHA512 0e1049ba74c3054528129e7cd3f251ed77dee2a4ee37d7ffb79216f660c3b8822621c8dc8d3dfb6d607f0850b97c1b865816d902f05a2063f198d9a265b1bbd3
- SSDEEP 6144:UrGkVCHR0gTHhCXgB4re+bYlRmbDxtagMNsFUIIO3lyz0Q:UERjTBCXgST/xMA1E
- TLSH
  T145D41706F98B5D68E089CCB5C3478A561E1575CB0B3AB9BF02C551382F6E7F16F2821B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Comprobante_Actualizacion/anybrainSDK.dll
- Size 8.4MB
- SHA256 40c602f25da32221a6ce6661eece49a26157a490b878d373fe9d62af9197cd85
- MD5 a2f3b7a2658671650d80b46ba4458dfe
- SHA1 415380d2d1300546178ce3e18a7ed8dc5114b278
- SHA512 fed38db641cd96bae2ddde1427403c27493a02aba40749ec9b2b94f1fef950dc434ad30eb59e3ddd7a98ce741a4e032bdd5e84b58b732299f2e3d8d2f2e4439b
- SSDEEP 196608:1WU2HY0OX0vTshgRSYjSncjNa+UDhtxCu6VX3dYE:1ZEY0JR1+rCtVX3WE
- TLSH
  T12596332BA2A2FDE5F52323B11715C18677366BB22F19875DBA1F8ED3892125CCB37104
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
behavioral9
- Target
  Comprobante_Actualizacion/baselib.dll
- Size 236KB
- SHA256 cef936ec30c6c077f2089b3200cc82fec8c6fa71758aa98291705b6296ac8028
- MD5 3c6c0de5f9497161d6b99fc83e18320a
- SHA1 f9c7a1e503158bbda9d7ebcb14bb7a4ca18b215e
- SHA512 f700bb512b0ebb36fecd392ee1234ba719535cb09bf000f2e0d59c6fec1b4f8f70e7484d591dd84b2689b662145dd8750c404796034723eeac98f6c0a64227aa
- SSDEEP 3072:QAek/vSCKqHgMPuplt90vtE5NNjsp7ZKltrSibdYJl38:QAeoPgMPi0vtQ12MSkYTs
- TLSH
  T145348D4972A40D66FD7741B4CD536A16E67238034740CACF43E483A5AE6BBD05A3FB72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Comprobante_Actualizacion/discord_partner_sdk.dll
- Size 9.2MB
- SHA256 76f93b0362413eb7af28021f48d9ec0218b7218fbd3c79860fcc5fded3ecda8a
- MD5 5455dba7346ba30561ab063093214089
- SHA1 a74d67b763ee301b3b56b18a35139e674cbbd048
- SHA512 cab945342670e9a2cc41ef0afbd750822494ec2bc4d7eceec655c9d3ed3e520d4c8066b6d571e4fc894524feacf7ee76ecd67fd7a726d364bf824481d93f2c97
- SSDEEP 196608:FPeGMyn3DcqhX/liOYZdx47Vk3Du/35NkYQpV28:FPeGMyn3DcqhX/YOYZdx47Wzu/35iYQr
- TLSH
  T16AA65B03F78A50FDC49AD078975BA526FA31788E032579DB07909B252FB7BE05B39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Comprobante_Actualizacion/lib_burst_generated.dll
- Size 615KB
- SHA256 78aa92c51ef25d53f9a1c1b5ac126bae1ac26250362540db1a8aee3e455cb667
- MD5 dc3f08d107e830dbdaf8b92a0aafeaf3
- SHA1 0053d1ea119c29c2c1ac86c134e5e825bdc15f38
- SHA512 65e34b399590fa1fe6e2b650ae58c72ae0665b7f8f1c4042be04c088396a28e657c68047a6cf49fab9d71993633f1af1966d02cf14e37265728fec783e9946a8
- SSDEEP 12288:5Gvi3lej2kgPNMdpfOe8m3gXrm061TVBSmEm9:5G+wSkD2epwrESmEc
- TLSH
  T171D46D2D2193BDEAC01EC47002ABEE9372327C0917809EE35192757A2DF55D71FBA92D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Comprobante_Actualizacion/libsodium.dll
- Size 464KB
- SHA256 a4f44fb5c36fd1e43fd60e9de76acb7a66996cde22576165b51c23087dc4dbc0
- MD5 d6a8ea2df0a2e1db833609c18fbc7ba8
- SHA1 c4c97b877394036e8e7d8a269c047e74463b4dc3
- SHA512 971efa547bb97f31ae148f579768f7b1a10623093da07435e8efc13981208b659df8259746c352c785cc71fd15a0c3938a33e96fb4883e86f8d0eeb663c05d36
- SSDEEP 12288:bHo1Rl82Mhcc+2eTrU+td0YAsMlDOERDrhD:bHoF82Mhcc+2eTrU+td03s4DOSrhD
- TLSH
  T161A47B5EFEF68DE4C977E078817E9267FA51780C43306AE71392849439537E5A23DB02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Comprobante_Actualizacion_Tramite.exe
- Size 2.9MB
- SHA256 c9b448d0b12fb5d846a345692c55ec0ce10c4bdd26cac2acf045de0c823cb296
- MD5 4b9829be90f19f8cfd39cc529a23a930
- SHA1 c10e0fd2a12714859128f9502075af200f04711f
- SHA512 cae312e1fc74316545ba2ad78effdd638590018270eb182ea742dfdcd6ecdf3592e2d3fc867bb26f68d4dddfe4a47e508c39d0d6e208053401fc8b84ac812d4e
- SSDEEP 49152:HjpMVyEQ1fzKreOU7i+fk797hqIZnDUBmPGQfj9b16i+aNk:Hj6qOUO/PVGQr9boXam
- TLSH
  T1BFD59D0B7DA158E9C4EA923689B352563B71FC090F3663D72D90B3383E76AE05D39B44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14