remus_stealer | 129917ed452c3eb6c19552d38ab4d2b4a741c35d8da76dd9b0313b868ef54c08

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_8e82c29c8f56e5c8688ed59fa9b96ec1_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 3.1MB
Sample260804-mx374adj2z
SHA256 129917ed452c3eb6c19552d38ab4d2b4a741c35d8da76dd9b0313b868ef54c08
MD5 8e82c29c8f56e5c8688ed59fa9b96ec1
SHA1 fd254f312fb2d68f00f75ad55aacd6a3bc8a8537
SHA512 d960f58fa34d54df8a932616964b16a69a797e63698b46e318f5f171c7e91c0c3095885f5104af7e1a583a36fa4a45939789569cabaad21772a8ab571fab88de
SSDEEP 49152:eaRCNmy5vCwRK6uy0DJbvP4fkDFj0B67lDAZpB:eJ67Lj0B67SZ3
TLSH
T145E56C03BDA448F9C0DAE73988676266B674BC09473233D32E917AB92F767D09E34744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remus_stealer spyware stealer

Malware Config

Extracted

Family

remus_stealer

http://fimmora.surf:6504
http://zelpx.garden:9895
http://tzpx.courses:4437

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Detects Remus stealer 1 IoCs

resource	yara_rule
behavioral1/memory/2960-1-0x0000000140000000-0x000000014003B000-memory.dmp	family_remus_stealer

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

C:\Users\Admin\AppData\Local\Temp\2026-08-03_8e82c29c8f56e5c8688ed59fa9b96ec1_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_8e82c29c8f56e5c8688ed59fa9b96ec1_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
PID:2960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2960-0-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/2960-1-0x0000000140000000-0x000000014003B000-memory.dmp