remus_stealer | f02eb5040f50f5bdade4c2a2114ec43c33bdf4a7fd9051f9f7d411eb50b1474e

Analysis

max time kernel
164s
max time network
164s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 10:45

Target
file.exe
Size 4.1MB
Sample260810-mtqslafq2v
SHA256 f02eb5040f50f5bdade4c2a2114ec43c33bdf4a7fd9051f9f7d411eb50b1474e
MD5 fdb6448a3ac57e511a53cda07945be8f
SHA1 35170d38f2089910e6dc71ea9a2fd202f6dd2736
SHA512 a51ad5a2c4b57becaac22cd301025dfbc74d4c74fe1b883002eadbcabe68d3b2e3f33a22daef2cb1c9ebcc84d43e18fd4c68622b1d3e476f614e8373099892c3
SSDEEP 98304:/b3osRj07odi0u2/r28ooycdvb5aRaFeGzTl7ez2Il:7DkoVuwravcOgFegyiIl
TLSH
T1BB163338BEC257A7E71172BC7D9D1984DEE35CC1138B8A462A4F40885F69FCA47432A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe

Downloads MZ/PE file 3 IoCs

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral2/memory/1408-0-0x0000000140000000-0x0000000140B0D000-memory.dmp	themida
behavioral2/memory/1408-1-0x0000000140000000-0x0000000140B0D000-memory.dmp	themida
behavioral2/memory/1408-2-0x0000000140000000-0x0000000140B0D000-memory.dmp	themida
behavioral2/memory/1408-6-0x0000000140000000-0x0000000140B0D000-memory.dmp	themida
behavioral2/memory/1408-8-0x0000000140000000-0x0000000140B0D000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 6 IoCs