remus_stealer | 6a406376be3f0dc3c700a8c637b5c4a111c8e013b49f2100dace21520aeec4b8

Analysis

max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/08/2026, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
664942504.exe
Size 5.1MB
Sample260822-athe1atzas
SHA256 6a406376be3f0dc3c700a8c637b5c4a111c8e013b49f2100dace21520aeec4b8
MD5 3e32d60a5fb71b7a658d69b31402934f
SHA1 03340851d47839d344cfb8c1880aff5b164de902
SHA512 9221a899e073f21388584c482bfb26b0402d1b4a017c647fc83a5da3df096b3ee6201c4098f64a9e5838b55144f0036895ea64988098bcabfbca9d382a70c135
SSDEEP 49152:S+Ux99IDm1FYHvHW5pbEvBDFT1FUrg7TmXi:pQ9kci/0uJFFXb
TLSH
T131365A07BCA545A9C0AAA734C9A787127B75BC88873233D72E50BA383F76BD05E75740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery remus_stealer spyware stealer

Malware Config

Extracted

Family

remus_stealer

http://kupzovo.shop:7567/posts
http://vexdico.shop:8539/webhooks
http://mrlketo.shop:8932/orders

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5324	664942504.exe
5324	664942504.exe
5324	664942504.exe
5324	664942504.exe

C:\Users\Admin\AppData\Local\Temp\664942504.exe
"C:\Users\Admin\AppData\Local\Temp\664942504.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5324-0-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/5324-1-0x0000000140000000-0x000000014003B000-memory.dmp

Download