remus_stealer | 4543006aca3bdc0e761d2c7bf36f2dedc6a54ed55e9e6cf9e09076955242a6b7

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vsdbg.dll
Size 3.1MB
Sample260717-aasfvsbx31
SHA256 4543006aca3bdc0e761d2c7bf36f2dedc6a54ed55e9e6cf9e09076955242a6b7
MD5 8bbb12edc473eb518502e2c2b2c2f9a5
SHA1 f6f315b6999bee0e1fef98f132e8cb5e99d18b7e
SHA512 9e1306d75a4bfeef624568c0308a8ae9e52de6421266dc5629ef6b041e01a0abe66d1d213f595a43e2b2e29284956c40fe52ccf251d6462bb5a84a031f7bd105
SSDEEP 49152:x1Nt0vu4eher3yr0NmZ4yYnJJuQkbooe/TBCs35yrNMBboYs26JNkx2iVvket+:Xveu50NcwQrNuUqIk4iV5t
TLSH
T178E5AD2F6EE44476EE168933D23B8333D6B876552637B96B0E86C2405E36E71032BD35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remus_stealer stealer

Malware Config

Extracted

Family

remus_stealer

http://tzpx.courses:4437
http://zelpx.garden:9895
http://carogra.biz:4219

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1728 set thread context of 1708	1728	rundll32.exe	87

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1708	1728	rundll32.exe	87
PID 1728 wrote to memory of 1708	1728	rundll32.exe	87
PID 1728 wrote to memory of 1708	1728	rundll32.exe	87
PID 1728 wrote to memory of 1708	1728	rundll32.exe	87
PID 1728 wrote to memory of 1708	1728	rundll32.exe	87
PID 1728 wrote to memory of 1708	1728	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vsdbg.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-3-0x0000000140000000-0x0000000140039000-memory.dmp

Download

memory/1728-2-0x0000000180000000-0x0000000180335000-memory.dmp

Download

memory/1728-1-0x0000000180000000-0x0000000180335000-memory.dmp

Download

memory/1728-0-0x0000000180000000-0x0000000180335000-memory.dmp

Download

memory/1728-4-0x0000000180000000-0x0000000180335000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads