remus_stealer | 6a406376be3f0dc3c700a8c637b5c4a111c8e013b49f2100dace21520aeec4b8

Analysis

max time kernel
149s
max time network
149s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/08/2026, 00:30

Target
664942504.exe
Size 5.1MB
Sample260822-athe1atzas
SHA256 6a406376be3f0dc3c700a8c637b5c4a111c8e013b49f2100dace21520aeec4b8
MD5 3e32d60a5fb71b7a658d69b31402934f
SHA1 03340851d47839d344cfb8c1880aff5b164de902
SHA512 9221a899e073f21388584c482bfb26b0402d1b4a017c647fc83a5da3df096b3ee6201c4098f64a9e5838b55144f0036895ea64988098bcabfbca9d382a70c135
SSDEEP 49152:S+Ux99IDm1FYHvHW5pbEvBDFT1FUrg7TmXi:pQ9kci/0uJFFXb
TLSH
T131365A07BCA545A9C0AAA734C9A787127B75BC88873233D72E50BA383F76BD05E75740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 4 IoCs

C:\Users\Admin\AppData\Local\Temp\664942504.exe
"C:\Users\Admin\AppData\Local\Temp\664942504.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1804

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1804-0-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/1804-1-0x0000000140000000-0x000000014003B000-memory.dmp

Download