remus_stealer | 2ecc8f99a7860a6806347bc55842e71f2baa81afeffd7f0dbcebe22da5228a2e

Analysis

max time kernel
300s
max time network
297s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/07/2026, 06:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
𝙎𝙀𝙏𝙐𝙋.exe
Size 2.8MB
Sample260723-hbfsfssfkf
SHA256 2ecc8f99a7860a6806347bc55842e71f2baa81afeffd7f0dbcebe22da5228a2e
MD5 8316c11965ea33d19a0b81e1b1d3e1c1
SHA1 919b5673aced7f5b239450ff52c3c4d492249c1c
SHA512 db1fded1b9895413000525a3845030dac24860aabf509a39077138ae32e2b038a0027b9cdbc4c5abf2caeb3616d2ed580e87331b672685b930ee299de1101ec6
SSDEEP 49152:l6MBLgiD0f5JO9q5ao1vn3doX7J2XCa80qB:llE6Cp80k
TLSH
T173D54A17ECE148F6C199A231C9B396527775BC081B3237EB2E90AB782E727D05D3A714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery remus_stealer spyware stealer

Malware Config

Extracted

Family

remus_stealer

http://zelpx.garden:9895
http://fimmora.surf:6504
http://tzpx.courses:4437

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Detects Remus stealer 3 IoCs

resource	yara_rule
behavioral2/memory/2632-0-0x0000000140000000-0x0000000140039000-memory.dmp	family_remus_stealer
behavioral2/memory/2632-1-0x0000000140000000-0x0000000140039000-memory.dmp	family_remus_stealer
behavioral2/memory/2632-2-0x0000000140000000-0x0000000140039000-memory.dmp	family_remus_stealer

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2632	𝙎𝙀𝙏𝙐𝙋.exe
2632	𝙎𝙀𝙏𝙐𝙋.exe
2632	𝙎𝙀𝙏𝙐𝙋.exe
2632	𝙎𝙀𝙏𝙐𝙋.exe

C:\Users\Admin\AppData\Local\Temp\𝙎𝙀𝙏𝙐𝙋.exe
"C:\Users\Admin\AppData\Local\Temp\𝙎𝙀𝙏𝙐𝙋.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2632-0-0x0000000140000000-0x0000000140039000-memory.dmp

Download

memory/2632-1-0x0000000140000000-0x0000000140039000-memory.dmp

Download

memory/2632-2-0x0000000140000000-0x0000000140039000-memory.dmp

Download