remus_stealer | 75918e6ed3b6cad31961c1de81c3966c3a0eceaf1e334118f546f587268728d3

Analysis

max time kernel
898s
max time network
405s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/08/2026, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Helper.exe
Size 1.6MB
Sample260831-fa28ysvdjf
SHA256 75918e6ed3b6cad31961c1de81c3966c3a0eceaf1e334118f546f587268728d3
MD5 b5e27b0528e43c04a9688f5fc9b3f8b2
SHA1 404e7b06ea3189c8251d06bcbc0794f5f8a74f5f
SHA512 c0430d31defe6e9758fadc86bca50a894838bfc92a54648e993b6d1825be8cb02c906c6458df5d3c5ac5a8efa72322a345d204947fb631af64e750ba710c8e46
SSDEEP 49152:EdBfeFySbqf2ro8JaJxEZc+ed5OazNAo4t97GfZ4hvtM:EdvktJacZq5OazP4taU
TLSH
T18A7512623BD68528D4B16FB57BFAC28BD3757C400F5A16D76324772C6B32AC07E20266
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remus_stealer stealer

Malware Config

Extracted

Family

remus_stealer

http://uiccvbk.click:8839/invoices
http://shhsift.click:7647/users
http://cdire.shop:9048/accounts

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Executes dropped EXE 2 IoCs

pid	Process
1596	AutoIt3.exe
3248	AutoIt3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1596 set thread context of 3248	1596	AutoIt3.exe	83

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1596	AutoIt3.exe
1596	AutoIt3.exe
1596	AutoIt3.exe
1596	AutoIt3.exe
1596	AutoIt3.exe
1596	AutoIt3.exe
1596	AutoIt3.exe
1596	AutoIt3.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1596	AutoIt3.exe
1596	AutoIt3.exe
1596	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1596	AutoIt3.exe
1596	AutoIt3.exe
1596	AutoIt3.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 5832	4284	Helper.exe	80
PID 4284 wrote to memory of 1596	4284	Helper.exe	82
PID 1596 wrote to memory of 3248	1596	AutoIt3.exe	83
PID 1596 wrote to memory of 3248	1596	AutoIt3.exe	83
PID 1596 wrote to memory of 3248	1596	AutoIt3.exe	83

C:\Users\Admin\AppData\Local\Temp\Helper.exe
"C:\Users\Admin\AppData\Local\Temp\Helper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SYSTEM32\at.exe
  at.exe /8576uhsdfjkgh2034958
  2⤵
  PID:5832
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe No.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    PID:3248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

No.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\No.a3x
Size 860KB
SHA256 95ca6af21feca7461118a10e9bee1e2fc0d8b4f11938d33f169b7fe2eb8bca8a
MD5 b8463ca935b0b551b11870b1eeef9d31
SHA1 eb842ea89c8e3dea5c6f2ee01a2a2dec158c01d4
SHA512 351521dd224e4718030bd871b1f3e6863ff2de4f8fc049d7f8ffde2abfff789d65a108c83a433f87ad30ba3f94295d19606347e5cdd8d56f65f591295a3879a8
SSDEEP 24576:XSZirO8AIJDF6ZtxQzwdVo+ba8N4DKt6t33tz0Bmzr:yirO8AIJZ6Z3AwdCga8N4mts9fP
TLSH
T1CA1533EFA7A9DF29E43DB696031D4AF9E2D774651FC874C01464387E202ECE1A807867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1596-7-0x00007FFFF9C60000-0x00007FFFF9E69000-memory.dmp

Download

memory/1596-8-0x000001B53CAD0000-0x000001B53CAD1000-memory.dmp

Download

memory/3248-10-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/3248-11-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/3248-15-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/3248-13-0x0000000140000000-0x000000014003B000-memory.dmp

Download

memory/3248-16-0x0000000140000000-0x000000014003B000-memory.dmp

Download