remus_stealer | 480f2ddeaa596166f6a4a4334f797915f04c99fe233d51cc43b9b79a52464980

Analysis

max time kernel
38s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 11:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
480f2ddeaa596166f6a4a4334f797915f04c99fe233d51cc43b9b79a52464980.exe
Size 1.7MB
Sample260817-ngltjsam21
SHA256 480f2ddeaa596166f6a4a4334f797915f04c99fe233d51cc43b9b79a52464980
MD5 c310a101987cdf1de355146f464af098
SHA1 5013baa3c730c09b81bdbde13b27c094fb9fc23e
SHA512 cd3c32124d5722e804d387474b90120a947b8223fc28d656d4f539d414257359f9bae9690db2f252eeb99725af892942da8f6ab814335b4fa80b4d6231d4ab7c
SSDEEP 24576:/7p/q1PYSqGdrs3Pnot0+BZmlXkT4eMAfqjfxUFYbu1oqE+RMTYI6AqdLgBwp2Ac:FChzdYfu0UclUUelfqjJgNI6Rp2/9nl
TLSH
T15F85231257E0955BEAF817B484F69A779A31B8439FF0A29F32141D4E7E11AC0F23139B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remus_stealer stealer

Malware Config

Extracted

Family

remus_stealer

http://mrlketo.shop:8932/permissions
http://vexdico.shop:8539/customers
http://kupzovo.shop:7567/posts

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Executes dropped EXE 2 IoCs

pid	Process
4036	AutoIt3.exe
4896	AutoIt3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4036 set thread context of 4896	4036	AutoIt3.exe	88

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3864	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4036	AutoIt3.exe
4036	AutoIt3.exe
4036	AutoIt3.exe
4036	AutoIt3.exe
4036	AutoIt3.exe
4036	AutoIt3.exe
4036	AutoIt3.exe
4036	AutoIt3.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4036	AutoIt3.exe
4036	AutoIt3.exe
4036	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4036	AutoIt3.exe
4036	AutoIt3.exe
4036	AutoIt3.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 3864	1832	480f2ddeaa596166f6a4a4334f797915f04c99fe233d51cc43b9b79a52464980.exe	85
PID 1832 wrote to memory of 4036	1832	480f2ddeaa596166f6a4a4334f797915f04c99fe233d51cc43b9b79a52464980.exe	87
PID 4036 wrote to memory of 4896	4036	AutoIt3.exe	88
PID 4036 wrote to memory of 4896	4036	AutoIt3.exe	88
PID 4036 wrote to memory of 4896	4036	AutoIt3.exe	88

C:\Users\Admin\AppData\Local\Temp\480f2ddeaa596166f6a4a4334f797915f04c99fe233d51cc43b9b79a52464980.exe
"C:\Users\Admin\AppData\Local\Temp\480f2ddeaa596166f6a4a4334f797915f04c99fe233d51cc43b9b79a52464980.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SYSTEM32\ipconfig.exe
  ipconfig.exe /73465298ehfjshdf87934
  2⤵
  - Gathers network information
  PID:3864
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Diverse.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Diverse.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Diverse.a3x
Size 1.0MB
SHA256 e40c75b907470d675b5d6bac353f184afa04d4735ee1a9a6533fb2b71a2332b6
MD5 d383c52599f461ab7b62e9a7651dd85e
SHA1 c597ed5a842df9bbdde71a70e07c6f9eb2e2549f
SHA512 58fae07bb427b8eacdb0630471eb1b16316db946e1f26757c3f16ee7a00d7f37ec5de59ceeed1a6a63f3ca42bcc3a573e406230b11746c7ef1a3e50c7013c022
SSDEEP 24576:+GdIb3Pnol0IBZNQRCTY3EOfj0fcdm2buyo88y2MTYmwAqd2wpF:/d0fm0abQsE3ffj00ojmw7
TLSH
T145353314ECA5BB15BEDC2A94811DBAF646F2551ADBF5707AF018360FF40C708B242BDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4036-7-0x00007FFA4CB90000-0x00007FFA4CD85000-memory.dmp

Download

memory/4036-8-0x000002AA380A0000-0x000002AA380A1000-memory.dmp

Download

memory/4896-10-0x000001F9B53B0000-0x000001F9B53EB000-memory.dmp

Download

memory/4896-11-0x000001F9B53B0000-0x000001F9B53EB000-memory.dmp

Download

memory/4896-15-0x000001F9B53B0000-0x000001F9B53EB000-memory.dmp

Download

memory/4896-13-0x000001F9B53B0000-0x000001F9B53EB000-memory.dmp

Download

memory/4896-16-0x000001F9B53B0000-0x000001F9B53EB000-memory.dmp

Download