Leaf.it.Alone.v1.0.16.zip
- SHA256 d3c2d1823349c2fe248b113f8f1c1b3844d62d6e5000c17f04dc4d95473d1583
Behavioral task
behavioral1
Sample
Leaf.it.Alone.v1.0.16.zip
Resource
win10ltsc2021-20260513-es
Behavioral task
behavioral2
Sample
Leaf.it.Alone.v1.0.16.zip
Resource
win11-20260513-es
Remus is a stealer written in C++.
| resource | yara_rule |
|---|---|
| static1/unpack001/Leaf.it.Alone.v1.0.16/Leaf.it.Alone.v1.0.16/Leaf it Alone_Data/Plugins/x86_64/discord_partner_sdk.dll | family_remus_stealer |
File was altered after it was signed.
| resource |
|---|
| unpack001/Leaf.it.Alone.v1.0.16/Leaf.it.Alone.v1.0.16/UnityPlayer.dll |
File was codesigned using an insecure algorithm.
| resource |
|---|
| unpack001/Leaf.it.Alone.v1.0.16/_Redist/xnafx40_redist.msi |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Leaf.it.Alone.v1.0.16/Leaf.it.Alone.v1.0.16/GameAssembly.dll |
| unpack001/Leaf.it.Alone.v1.0.16/Leaf.it.Alone.v1.0.16/Leaf it Alone.exe |
| unpack001/Leaf.it.Alone.v1.0.16/Leaf.it.Alone.v1.0.16/Leaf it Alone_Data/Plugins/x86_64/lib_burst_generated.dll |
| unpack001/Leaf.it.Alone.v1.0.16/Leaf.it.Alone.v1.0.16/Leaf it Alone_Data/Plugins/x86_64/libzstd.dll |
| unpack001/Leaf.it.Alone.v1.0.16/Leaf.it.Alone.v1.0.16/Leaf it Alone_Data/Plugins/x86_64/lz4.dll |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/Leaf.it.Alone.v1.0.16/Leaf.it.Alone.v1.0.16/Leaf it Alone_Data/Plugins/x86_64/steam_api64.dll |
| unpack001/Leaf.it.Alone.v1.0.16/_Redist/dotNetFx40_Full_setup.exe |
| unpack001/Leaf.it.Alone.v1.0.16/_Redist/dxwebsetup.exe |
| unpack001/Leaf.it.Alone.v1.0.16/_Redist/oalinst.exe |
| unpack001/Leaf.it.Alone.v1.0.16/_Redist/vcredist_x64.exe |
| unpack001/Leaf.it.Alone.v1.0.16/_Redist/vcredist_x86.exe |
Nov 16, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=5, id=259, version=30795,
count=158, id=261, version=30795,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33030,
count=18, id=259, version=33030,
count=2, id=257, version=30795,
count=89, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=260, version=30795,
count=298, id=1, productName=Unmarked objects,
count=87, id=261, version=33030,
count=87, id=261, version=33130,
count=1, id=256, version=33130,
count=1, id=255, version=33130,
count=1, id=151,
count=1, id=258, version=33130,
Unsigned PE
Checks for missing Authenticode signature.
count=177, id=261, version=33145,
count=68, id=260, version=33145,
count=37, id=259, version=33145,
count=1, id=253, version=35207,
count=14, id=260, version=35207,
count=13, id=259, version=35207,
count=83, id=261, version=35207,
count=2, id=257, version=34433,
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=262, version=33145,
count=23, id=257, version=33145,
count=312, id=1, productName=Unmarked objects,
count=610, id=261, version=35221,
count=146, id=260, version=35221,
count=1, id=256, version=35221,
count=1, id=258, version=35221,
Unsigned PE
Checks for missing Authenticode signature.
count=5, id=259, version=28900,
count=138, id=261, version=28900,
count=10, id=260, version=28900,
count=2, id=257, version=28900,
count=9, id=259, version=34321,
count=16, id=260, version=34321,
count=40, id=261, version=34321,
count=3, id=257, version=34433,
count=89, id=1, productName=Unmarked objects,
count=2, id=261, version=34433,
count=1, id=256, version=34433,
count=1, id=255, version=34433,
count=1, id=258, version=34433,
Detects Remus stealer
Dec 4, 2025
SERIALNUMBER=5128862,CN=Discord Inc.,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=5128862,CN=Discord Inc.,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jul 24, 2026
CN=GSE,OU=GSE,O=GSE,C=UK
Sep 17, 2025
SERIALNUMBER=3183233,CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=3183233,CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=8, id=259, version=28900,
count=188, id=261, version=28900,
count=24, id=260, version=28900,
count=1, id=253, version=34321,
count=10, id=259, version=34321,
count=19, id=260, version=34321,
count=88, id=261, version=34321,
count=1, id=262, version=28900,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=29, id=257, version=28900,
count=302, id=1, productName=Unmarked objects,
count=64, id=265, version=34433,
count=1, id=255, version=34433,
count=1, id=258, version=34433,
Codesign digest Mismatch
File was altered after it was signed.
Jan 1, 0001
count=18, id=260, version=34321,
count=29, id=259, version=34321,
count=38, id=259, version=28900,
count=107, id=260, productName=VS2019 v16.8.0 build 29333, version=29333,
count=34, id=260, version=31935,
count=111, id=261, productName=VS2019 v16.8.0 build 29333, version=29333,
count=74, id=260, version=28900,
count=44, id=257, version=28900,
count=8, id=253, version=34321,
count=91, id=261, version=34321,
count=149, id=261, version=31935,
count=224, id=261, version=28900,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=603, id=1, productName=Unmarked objects,
count=32, productName=Unmarked objects (old),
count=1327, id=265, version=34433,
count=1, id=256, version=34433,
count=1, id=255, version=34433,
count=1, id=258, version=34433,
Sep 17, 2025
SERIALNUMBER=3183233,CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=3183233,CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=5, id=259, version=28900,
count=137, id=261, version=28900,
count=11, id=260, version=28900,
count=9, id=259, version=34321,
count=14, id=260, version=34321,
count=42, id=261, version=34321,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=158, id=1, productName=Unmarked objects,
count=5, id=257, version=28900,
count=3, id=265, version=34433,
count=1, id=256, version=34433,
count=1, id=258, version=34433,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Mar 19, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=1, id=158, version=20928,
count=3, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=43, id=171, version=21009,
count=18, id=158, version=21009,
count=105, id=170, version=21009,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=194, id=1, productName=Unmarked objects,
count=69, id=175, version=20928,
count=1, id=171, version=20928,
count=1, id=155, version=20928,
count=1, id=154, version=20928,
count=1, id=157, version=20928,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jun 2, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=13, id=25, version=9210,
count=126, id=1, productName=Unmarked objects,
count=1, id=69, version=9111,
count=24, id=28, version=9178,
count=1, id=61, version=9210,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jun 3, 2009
CN=Creative Labs Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=CLI,O=Creative Labs Inc,L=Milpitas,ST=California,C=US
count=18, id=125, productName=VS2005 build 50727, version=50727,
count=107, id=109, productName=VS2005 build 50727, version=50727,
count=11, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=135, id=1, productName=Unmarked objects,
count=9, productName=Unmarked objects (old),
count=34, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Jan 8, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jan 8, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=9, id=241, version=40116,
count=124, id=243, version=40116,
count=24, id=242, version=40116,
count=19, id=259, version=24123,
count=19, id=260, version=24123,
count=38, id=261, version=24123,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=337, id=1, productName=Unmarked objects,
count=75, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=2, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Jan 8, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jan 8, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=9, id=241, version=40116,
count=124, id=243, version=40116,
count=24, id=242, version=40116,
count=19, id=259, version=24123,
count=19, id=260, version=24123,
count=38, id=261, version=24123,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=337, id=1, productName=Unmarked objects,
count=75, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=2, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Mar 19, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=1, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=125, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=32, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Mar 19, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=1, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=125, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=32, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Aug 23, 2010
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US