remus_stealer | 82b1a5ffdf569695f522537b98a78aa0dc655b7700efdbe80e1e664891cf709c

Analysis

max time kernel
300s
max time network
184s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/08/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FLTLIB.dll
Size 33.3MB
Sample260819-al8bfstdlb
SHA256 82b1a5ffdf569695f522537b98a78aa0dc655b7700efdbe80e1e664891cf709c
MD5 987ea6e787945b049b32c1bdb31b54aa
SHA1 da97a8cfeeecbc1af4d034bb877f9558840a4fe3
SHA512 dde8c30a6f8c925142afae743ba10cb8e2639a46f405919565f0a8f30e1270d8e16f342f587301783b6b75fc0a04cf8dd17546b7ffbaa9682e47c3b7aa6d3bf7
SSDEEP 196608:gBw90Fzm+TtnKz7Puu0cRzOeYT9UMeN/I5usq:gBw90FvTiT0S6eYTOMepxl
TLSH
T1D5778C05A39705ABD436DAF8CA3492F2F2B37D524636814B0959F63F1F73A504B3BA21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remus_stealer spyware stealer

Malware Config

Extracted

Family

remus_stealer

http://vexdico.shop:8539/users
http://mrlketo.shop:8932/comments
http://kupzovo.shop:7567/subscriptions

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2240 set thread context of 2472	2240	rundll32.exe	83

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2472	2240	rundll32.exe	83
PID 2240 wrote to memory of 2472	2240	rundll32.exe	83
PID 2240 wrote to memory of 2472	2240	rundll32.exe	83
PID 2240 wrote to memory of 2472	2240	rundll32.exe	83
PID 2240 wrote to memory of 2472	2240	rundll32.exe	83
PID 2240 wrote to memory of 2472	2240	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FLTLIB.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2472-0-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/2472-2-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/2472-3-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/2472-4-0x0000000140000000-0x000000014003B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads