remus_stealer | 45f35d4c5898a814aabc01ff69e81de600e861c0b72d67f7b30808b6b54082ca

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QW1.exe
Size 2.6MB
Sample260826-pl98dadn2s
SHA256 45f35d4c5898a814aabc01ff69e81de600e861c0b72d67f7b30808b6b54082ca
MD5 f4bf2e36035a8eefb7f66c2d21480ca1
SHA1 ce8ec0d4f16b41a33d75c016758e08b95edbe5e7
SHA512 5edb0a53bf2fc71bb1d8dfd389683cd25114103fe7dc23b9a35ca1f8f64ae367cdd007a983ad353161db9ea999a4f34647469c2ddd70721b1ca95cd1d845b172
SSDEEP 49152:1ioxAS4qJCQsn1jwALEDe1Sgv/SGdZqD17+V:wiCQclwg
TLSH
T175C55B037E84A1B4D4DABA3489765251B3317C8C9B3033D72E656B751EB63C26FB9388
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remus_stealer spyware stealer

Malware Config

Extracted

Family

remus_stealer

http://Cryptovectorhub3.lol:5478/accounts
http://fresok.top:9048/customers
http://shhsift.click:7647/documents

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

C:\Users\Admin\AppData\Local\Temp\QW1.exe
"C:\Users\Admin\AppData\Local\Temp\QW1.exe"
1⤵
PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3360-0-0x0000000140000000-0x0000000140039000-memory.dmp

Download

memory/3360-1-0x0000000140000000-0x0000000140039000-memory.dmp