General
- Target 2026-07-18_98c487df317423eaa5a9f8d85529a90f_snatch
- Size 1.8MB
- Sample260718-hsnjmabv6k
- SHA256 08edc14a35f0d2edb3db0b77ff28947eab0e3e1dea041e9bb9b6c5d1494e674b
- MD5 98c487df317423eaa5a9f8d85529a90f
- SHA1 7c6bfed08232276857a2202f6d02ab801a523512
- SHA512 fdf2997e86138fdd0748fde024a9db18e445061de4b731ed12b73598643176c3162d3b967a44863c9b0489cbee7ee3b5063556c0115047c4d9c91fda1882785c
- SSDEEP 24576:rZVEOm/ITTAgYAoZXpHtKbwjT5wu/xFzJwrMtPornCj4x/:rZVzkITTAgBoZvKbwjTOupFFwr3rn7x/
- TLSH T12E955B0ABCE008F6D06AA3328DB652927B72BC490F3223C72E90B5792F776D49D75754
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-18_98c487df317423eaa5a9f8d85529a90f_snatch.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_98c487df317423eaa5a9f8d85529a90f_snatch.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Malware Config
Extracted
Family
-
remus_stealer
Botnet
-
33affcf13f775e63f90369e9524544d8
C2
-
http://orderre.shop:4190
-
http://woodfez.biz:7582
-
http://firewai.biz:48261
Targets
-
- Target 2026-07-18_98c487df317423eaa5a9f8d85529a90f_snatch
- Size 1.8MB
- SHA256 08edc14a35f0d2edb3db0b77ff28947eab0e3e1dea041e9bb9b6c5d1494e674b
- MD5 98c487df317423eaa5a9f8d85529a90f
- SHA1 7c6bfed08232276857a2202f6d02ab801a523512
- SHA512 fdf2997e86138fdd0748fde024a9db18e445061de4b731ed12b73598643176c3162d3b967a44863c9b0489cbee7ee3b5063556c0115047c4d9c91fda1882785c
- SSDEEP 24576:rZVEOm/ITTAgYAoZXpHtKbwjT5wu/xFzJwrMtPornCj4x/:rZVzkITTAgBoZvKbwjTOupFFwr3rn7x/
- TLSH T12E955B0ABCE008F6D06AA3328DB652927B72BC490F3223C72E90B5792F776D49D75754
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Remus stealer