remus_stealer | cb1e15a47e40e7e1886531b829f4061c60b73ba4937e9161b4fc1fef846dfddb

Analysis

max time kernel
300s
max time network
162s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dollar.exe
Size 2.3MB
Sample260816-a7a8vaae48
SHA256 cb1e15a47e40e7e1886531b829f4061c60b73ba4937e9161b4fc1fef846dfddb
MD5 e496c36f3f7b9fb577fd06a1f62b105c
SHA1 bc154cf904b1d48ea12b805c56edd1d753981f0b
SHA512 31ef7ea6ef678c61822483203a29ec4487d29dab5fde6ce7a43242e10b6832fce389bbe5b45cc8871851dcd0564622e850adcea36ab8c9c7cbaeafd836a63e0d
SSDEEP 24576:B5D5y2VJW6p2O8Em/ATZiX6WBYOu4S4t690ttnlqaUY80yY7:vE2VJW6pmEu+4XbYODhtNfB
TLSH
T136B55A07BE8041A5D49AE736C9B64251B270BC4C873137D72F91AAB42F727D2AE76F10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery remus_stealer spyware stealer

Malware Config

Extracted

Family

remus_stealer

http://spareon.click:8811/imports
http://mrlketo.shop:8932/tasks
http://vexdico.shop:8539/users

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Downloads MZ/PE file 1 IoCs

flow	pid	Process
17	5756	dollar.exe

Executes dropped EXE 1 IoCs

pid	Process
3096	51BD2g7XqXFkykk96gXD3m.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5756	dollar.exe
5756	dollar.exe
5756	dollar.exe
5756	dollar.exe
5756	dollar.exe
5756	dollar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5756 wrote to memory of 3096	5756	dollar.exe	91

C:\Users\Admin\AppData\Local\Temp\dollar.exe
"C:\Users\Admin\AppData\Local\Temp\dollar.exe"
1⤵
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5756
- C:\Users\Admin\AppData\Local\Temp\51BD2g7XqXFkykk96gXD3m.exe
  "C:\Users\Admin\AppData\Local\Temp\51BD2g7XqXFkykk96gXD3m.exe"
  2⤵
  - Executes dropped EXE
  PID:3096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

51BD2g7XqXFkykk96gXD3m.exe

Path C:\Users\Admin\AppData\Local\Temp\51BD2g7XqXFkykk96gXD3m.exe
Size 1.6MB
SHA256 346b1b33d90911bc0e5a00f4bed37e1f648d94bd7e0466a5acc4d853904f68e1
MD5 307fe3eabd0da3f7324824a5ca30c66a
SHA1 42f86feda4100401f78f0d5677b178168b767a41
SHA512 e8bee8e428613fc08beb591658c9bac6e53ff5a9a7dfaf0d57afb040e394739c94fea6c778aa8369fd2f24b4a6a6669c67fe1e21bd42d5fe0a0cef09a92540d6
SSDEEP 49152:TN7nKCgG5xJDW7Ph1OqiPjB01p+TBgUCqBXVCQ:dKqR4OqafT2EVCQ
TLSH
T139750253EFA202F4C0A3993852BE6617E238380E87199DFBB7CD15903F2575859B9B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5756-0-0x0000000140000000-0x000000014003C000-memory.dmp

Download

memory/5756-1-0x0000000140000000-0x000000014003C000-memory.dmp

Download