remus_stealer | 82b1a5ffdf569695f522537b98a78aa0dc655b7700efdbe80e1e664891cf709c

Analysis

max time kernel
298s
max time network
191s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/08/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FLTLIB.dll
Size 33.3MB
Sample260819-al8bfstdlb
SHA256 82b1a5ffdf569695f522537b98a78aa0dc655b7700efdbe80e1e664891cf709c
MD5 987ea6e787945b049b32c1bdb31b54aa
SHA1 da97a8cfeeecbc1af4d034bb877f9558840a4fe3
SHA512 dde8c30a6f8c925142afae743ba10cb8e2639a46f405919565f0a8f30e1270d8e16f342f587301783b6b75fc0a04cf8dd17546b7ffbaa9682e47c3b7aa6d3bf7
SSDEEP 196608:gBw90Fzm+TtnKz7Puu0cRzOeYT9UMeN/I5usq:gBw90FvTiT0S6eYTOMepxl
TLSH
T1D5778C05A39705ABD436DAF8CA3492F2F2B37D524636814B0959F63F1F73A504B3BA21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery remus_stealer spyware stealer

Malware Config

Extracted

Family

remus_stealer

http://vexdico.shop:8539/users
http://mrlketo.shop:8932/comments
http://kupzovo.shop:7567/subscriptions

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3624 set thread context of 4136	3624	rundll32.exe	80

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4136	ServiceModelReg.exe
4136	ServiceModelReg.exe
4136	ServiceModelReg.exe
4136	ServiceModelReg.exe
4136	ServiceModelReg.exe
4136	ServiceModelReg.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 4136	3624	rundll32.exe	80
PID 3624 wrote to memory of 4136	3624	rundll32.exe	80
PID 3624 wrote to memory of 4136	3624	rundll32.exe	80
PID 3624 wrote to memory of 4136	3624	rundll32.exe	80
PID 3624 wrote to memory of 4136	3624	rundll32.exe	80
PID 3624 wrote to memory of 4136	3624	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FLTLIB.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4136-0-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/4136-2-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/4136-3-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/4136-4-0x0000000140000000-0x000000014003B000-memory.dmp

Download